Forte[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Forte.exe
Size 6.1MB
Sample261011-ql9saaad39
SHA256 3b58057b67b2cfbafb9b508b97a0377c00fd881c9e7e834014da85051f9ecf76
MD5 28d932e99d1c0976e92531d8eb919383
SHA1 2b7aa0689dc00d63d7b61cd6d206a6f9890c767f
SHA512 1ebcc69908558d156a1bd42ea6814b12ee08018060da1f33587c3833b5e7361a54458ca0e1d4e857c87cd51655239742b55bc413420ac9444890693dee938a64
SSDEEP 49152:tuPeiu9ryjkRDG7iD2dqE6LpPqH/ZlEqIN4RPnfLY7CWPUzDn0:tuu1ywRDIBdGLpiH/Zl1I/7
TLSH
T1FF567AB18A9C9B4DF06AB079C2875627A7F1BC0C6721DF8B9AD09CB74C1F590F15A20D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Forte.exe

File Explorer

Forte.exe

.exe 6.1MB

Forte.exe

IMPHASH b2f2f5bcd4a3aa2d57381881da3c313f
SHA256 3b58057b67b2cfbafb9b508b97a0377c00fd881c9e7e834014da85051f9ecf76
MD5 28d932e99d1c0976e92531d8eb919383
SHA1 2b7aa0689dc00d63d7b61cd6d206a6f9890c767f
SHA512 1ebcc69908558d156a1bd42ea6814b12ee08018060da1f33587c3833b5e7361a54458ca0e1d4e857c87cd51655239742b55bc413420ac9444890693dee938a64
SSDEEP 49152:tuPeiu9ryjkRDG7iD2dqE6LpPqH/ZlEqIN4RPnfLY7CWPUzDn0:tuu1ywRDIBdGLpiH/Zl1I/7
TLSH
T1FF567AB18A9C9B4DF06AB079C2875627A7F1BC0C6721DF8B9AD09CB74C1F590F15A20D
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6158016

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmExtendFrameIntoClientArea

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

winhttp

WinHttpReadData WinHttpCloseHandle WinHttpOpen WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpOpenRequest WinHttpConnect WinHttpSendRequest

kernel32

GetCurrentProcessId ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeSListHead GetSystemTimeAsFileTime Sleep GetTickCount64 OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW SleepConditionVariableSRW K32GetModuleBaseNameA K32GetModuleInformation ReadProcessMemory WideCharToMultiByte K32EnumProcessModules MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter GetModuleHandleW WriteProcessMemory GetStartupInfoW GetCurrentThreadId WakeAllConditionVariable SetUnhandledExceptionFilter CloseHandle

user32

TranslateMessage DefWindowProcW CreateWindowExW MapWindowPoints MoveWindow SetWindowLongW SetForegroundWindow GetKeyState GetMessageExtraInfo PeekMessageW ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData mouse_event GetAsyncKeyState GetClientRect GetSystemMetrics DispatchMessageW

advapi32

RegQueryValueExW

shell32

ShellExecuteA

d3dcompiler_43

D3DCompile

d3dx10_43

D3DXVec3Transform

msvcp140

?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?good@ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?_Xout_of_range@std@@YAXPEBD@Z _Mtx_lock _Mtx_unlock ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __C_specific_handler __current_exception_context __current_exception memset memmove memcpy memcmp __std_exception_destroy __std_exception_copy __std_terminate strstr memchr

api-ms-win-crt-heap-l1-1-0

_set_new_mode free malloc _callnewh

api-ms-win-crt-stdio-l1-1-0

fflush __stdio_common_vsscanf _wfopen __acrt_iob_func fseek ftell fclose _set_fmode _get_stream_buffer_pointers _fseeki64 fread fgetc __p__commode fsetpos fwrite freopen fputc ungetc setvbuf fgetpos __stdio_common_vfprintf __stdio_common_vsprintf

api-ms-win-crt-runtime-l1-1-0

_exit _beginthreadex _initterm_e _c_exit _get_wide_winmain_command_line _initialize_wide_environment terminate _configure_wide_argv _initterm _errno exit _set_app_type _register_thread_local_exe_atexit_callback _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-string-l1-1-0

isdigit tolower strcpy_s isxdigit _wcsicmp strcmp strlen strncmp strncpy wcslen

api-ms-win-crt-convert-l1-1-0

atoi strtol strtoull strtoll strtod

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale

api-ms-win-crt-math-l1-1-0

fmodf cosf powf __setusermatherr roundf atan2f sinf sqrtf ceilf acosf