f0rex_rater[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
f0rex_rater.exe
Size 42.0MB
Sample261003-wt7wjsvw3m
SHA256 362a0f91be5df893d16bac5dcf970b0418e9d3de15f20b32f9047300255553e3
MD5 260327d590893150e35546ba98e3e9c7
SHA1 d20d79d01921f9b3448c8cb9cb42c196d68b20ff
SHA512 14024c61a9945fe3bdcf9caecce84e227c0f114177dfc855cf65f67334fb3acc766758e67a91490c8008ee5582cbb75470e77477611b8aee099f3127224f2547
SSDEEP 786432:/9HQZDFWdJR6dJpjWdJYdmHJPqLvFGdJKdmN8Zu6S3S+RpkZVyVXmSCX:/YFWdJMdJxWdJYdmHJiMdJKdmN8ZJSiT
TLSH
T190A77C0AF4934F3EC1BA157184A79F16D539E0C1AB314AB7632863293DD23792AD339D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f0rex_rater.exe

File Explorer

f0rex_rater.exe

.exe 42.0MB

f0rex_rater.exe

IMPHASH fbc70d67b2c2242a7e2ea764bc65889f
SHA256 362a0f91be5df893d16bac5dcf970b0418e9d3de15f20b32f9047300255553e3
MD5 260327d590893150e35546ba98e3e9c7
SHA1 d20d79d01921f9b3448c8cb9cb42c196d68b20ff
SHA512 14024c61a9945fe3bdcf9caecce84e227c0f114177dfc855cf65f67334fb3acc766758e67a91490c8008ee5582cbb75470e77477611b8aee099f3127224f2547
SSDEEP 786432:/9HQZDFWdJR6dJpjWdJYdmHJPqLvFGdJKdmN8Zu6S3S+RpkZVyVXmSCX:/YFWdJMdJxWdJYdmHJiMdJKdmN8ZJSiT
TLSH
T190A77C0AF4934F3EC1BA157184A79F16D539E0C1AB314AB7632863293DD23792AD339D
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2436192

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\build\all_update_fixes\example_win32_directx11.pdb

d3d11

D3D11CreateDevice D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

advapi32

PrivilegeCheck SetTokenInformation OpenProcessToken RegCloseKey RegQueryValueExA RegOpenKeyExA LookupPrivilegeValueW RegGetValueW GetTokenInformation DuplicateTokenEx CreateProcessAsUserW SetThreadToken RevertToSelf

winhttp

WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpReceiveResponse WinHttpConnect WinHttpCrackUrl WinHttpQueryDataAvailable WinHttpOpen WinHttpReadData WinHttpSetTimeouts WinHttpQueryHeaders

crypt32

CryptUnprotectData CryptProtectData

kernel32

ReleaseSRWLockExclusive MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter OutputDebugStringA GetModuleFileNameW OpenProcess CreateToolhelp32Snapshot GetTickCount64 Process32NextW Process32FirstW CloseHandle Module32FirstW ReadProcessMemory Module32NextW VirtualQueryEx TerminateProcess GetEnvironmentVariableW GetTempPathW WaitForSingleObject DeleteFileW GetTempFileNameW GetExitCodeProcess SetEnvironmentVariableW LocalFree SetLastError GetLastError AcquireSRWLockExclusive SizeofResource WriteProcessMemory SetWaitableTimer GetCurrentProcess CreateWaitableTimerW GetSystemTimes SetThreadPriority Sleep GetCurrentThread MoveFileExW LockResource LoadResource FindResourceW GlobalFindAtomW SwitchToThread ExitProcess GlobalMemoryStatusEx CreateWaitableTimerExW GetStartupInfoW GetCommandLineW lstrcmpiW K32GetProcessMemoryInfo GetNativeSystemInfo lstrcmpW FindFirstFileA GetDriveTypeA FindNextFileA FindClose FormatMessageA AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFullPathNameW GetFinalPathNameByHandleW GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW CreateDirectoryW GetCurrentDirectoryW CreateFileMappingA UnmapViewOfFile MapViewOfFile HeapFree HeapAlloc ReadFile GetFileSizeEx CreateFileA GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetLocaleInfoEx GetFileInformationByHandleEx WaitForSingleObjectEx SleepConditionVariableSRW GetCurrentThreadId InitOnceComplete InitOnceBeginInitialize WakeAllConditionVariable GetModuleHandleW SetUnhandledExceptionFilter

user32

mouse_event IsIconic GetKeyboardLayout CreateWindowExW GetWindowThreadProcessId DefWindowProcW GetWindowRect DestroyWindow IsWindowVisible SetWindowPos MessageBoxW GetAncestor SetWindowLongPtrW GetSystemMetrics UnregisterClassW GetWindowLongPtrW RegisterClassExW GetWindowPlacement ShowWindow IsWindow DispatchMessageW PeekMessageW LoadKeyboardLayoutW EnumWindows SetLayeredWindowAttributes SetFocus keybd_event TranslateMessage ActivateKeyboardLayout PostQuitMessage UpdateWindow SetForegroundWindow SendInput GetMessageExtraInfo GetDC ScreenToClient GetCapture ClientToScreen TrackMouseEvent LoadCursorW SetCapture SetCursor GetClientRect ToUnicodeEx GetAsyncKeyState MapVirtualKeyW GetForegroundWindow GetKeyState SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos ReleaseDC SetCursorPos ReleaseCapture IsWindowUnicode

gdi32

DeleteDC CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt GetDIBits DeleteObject

shell32

ShellExecuteW

ole32

CoCreateInstance CoInitializeEx

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z _Cnd_broadcast _Thrd_join _Xtime_get_ticks _Thrd_id _Cnd_wait _Cnd_do_broadcast_at_thread_exit _Cnd_register_at_thread_exit ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?eof@ios_base@std@@QEBA_NXZ _Cnd_signal ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z __crtLCMapStringA ?__ExceptionPtrRethrow@@YAXPEBX@Z ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Random_device@std@@YAIXZ ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrCreate@@YAXPEAX@Z _Cnd_unregister_at_thread_exit ?uncaught_exceptions@std@@YAHXZ ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ _Strxfrm _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Id_cnt@id@locale@std@@0HA ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Strcoll _Query_perf_counter _Mtx_unlock ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBADD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??0task_continuation_context@Concurrency@@AEAA@XZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?id@?$numpunct@D@std@@2V0locale@2@A ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ _Thrd_yield ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

dwmapi

DwmExtendFrameIntoClientArea DwmFlush

urlmon

URLDownloadToFileW

winmm

timeBeginPeriod timeEndPeriod

dcomp

DCompositionCreateDevice

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception __current_exception_context __intrinsic_setjmp _CxxThrowException memcmp memchr __std_exception_copy memset memmove memcpy __std_terminate strstr strchr __C_specific_handler __std_type_info_compare __RTtypeid longjmp _purecall strrchr __std_exception_destroy

api-ms-win-crt-heap-l1-1-0

calloc free malloc _callnewh realloc _set_new_mode

api-ms-win-crt-string-l1-1-0

tolower isspace towlower isalnum isxdigit isdigit strncpy strcmp strncmp _wcsicmp strcpy_s strlen strncpy_s wcslen

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _exit exit _beginthreadex _initterm_e _initterm abort _wassert _get_initial_narrow_environment _set_app_type terminate _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func fflush fclose fseek _set_fmode __p__commode ftell fwrite _get_stream_buffer_pointers _fseeki64 fsetpos _wfopen ungetc setvbuf fgetpos __stdio_common_vfprintf fgetc __stdio_common_vsprintf_s __stdio_common_vsprintf fread fputc __stdio_common_vsscanf

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

atoi strtoul strtol atof strtof strtoull strtoll

api-ms-win-crt-math-l1-1-0

lround roundf atan2f sqrtf _fdclass llround ceilf fminf cosf _ldsign _fdsign _dsign expf floorf fmodf log log10 logf fmaxf sqrt sinf tanf __setusermatherr powf pow nearbyint lroundf acosf

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-time-l1-1-0

_localtime64_s strftime

api-ms-win-crt-locale-l1-1-0

___lc_locale_name_func _configthreadlocale ___lc_collate_cp_func ___lc_codepage_func