ff0l[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ff0l.exe
Size 2.1MB
Sample261015-yspppacy5m
SHA256 520b84f89083bac2236f3be9baec3a5deadbc5ea98793d222d8cbb1ec35cddd6
MD5 3ab9bf225ea9cf45521b530ad4324964
SHA1 479e7b39a08051f580278695bb1fe162fc6f3a8b
SHA512 3d4f67251ad9adc963417db252deca65f7f43cbd4c2b24c2a7ff2b6d0c9351a5c96f060d85e676452eb5c94881cb3387ef4fba8ac58fe993874aae60f5d3fa37
SSDEEP 24576:4mQkKvnBjoEzSUxO8CPWZ7teAq+c4nnIL0NbGvKjDEora0WwErXNuID/mTl7/mMo:40KxLz3vl9dnnILq5EohEAID/mt/d
TLSH
T1E8A5DF1BF3A3859DD726A578DA62A713E6F5B4260B3A85CB33445813EF969C4CFB4300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ff0l.exe

File Explorer

ff0l.exe

.exe 2.1MB

ff0l.exe

IMPHASH 88fa4491f0fd71a09b92dfd682c020f2
SHA256 520b84f89083bac2236f3be9baec3a5deadbc5ea98793d222d8cbb1ec35cddd6
MD5 3ab9bf225ea9cf45521b530ad4324964
SHA1 479e7b39a08051f580278695bb1fe162fc6f3a8b
SHA512 3d4f67251ad9adc963417db252deca65f7f43cbd4c2b24c2a7ff2b6d0c9351a5c96f060d85e676452eb5c94881cb3387ef4fba8ac58fe993874aae60f5d3fa37
SSDEEP 24576:4mQkKvnBjoEzSUxO8CPWZ7teAq+c4nnIL0NbGvKjDEora0WwErXNuID/mTl7/mMo:40KxLz3vl9dnnILq5EohEAID/mt/d
TLSH
T1E8A5DF1BF3A3859DD726A578DA62A713E6F5B4260B3A85CB33445813EF969C4CFB4300
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

469968

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpQueryHeaders WinHttpCloseHandle WinHttpReceiveResponse WinHttpSendRequest WinHttpConnect WinHttpReadData WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpSetOption

user32

SetCursor PostMessageW IsWindow GetWindowDisplayAffinity SetWindowDisplayAffinity IsWindowVisible OpenClipboard CloseClipboard SetClipboardData EmptyClipboard GetAsyncKeyState SendInput GetSystemMetrics GetCursorPos SetWindowLongPtrW GetWindowLongPtrW MessageBoxW ReleaseDC GetDC wsprintfA GetMonitorInfoA MonitorFromPoint SetWindowLongW GetWindowLongW SetLayeredWindowAttributes GetDpiForWindow LoadCursorA GetClientRect ReleaseCapture SetCapture GetCapture ClientToScreen GetClipboardData TrackMouseEvent LoadCursorW AdjustWindowRect KillTimer SetTimer SetWindowPos ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage GetCursorInfo GetWindow GetWindowThreadProcessId EnumWindows ClipCursor ScreenToClient

gdi32

CreateCompatibleDC AddFontMemResourceEx RemoveFontResourceExA ChoosePixelFormat CreateFontA SwapBuffers SetPixelFormat AddFontResourceExA GetTextMetricsA SelectObject GetGlyphIndicesW GetGlyphOutlineW DeleteObject DeleteDC

ole32

CoUninitialize CoInitializeEx CoCreateInstance CoCreateFreeThreadedMarshaler CoTaskMemFree

windowscodecs

WICConvertBitmapSource

d2d1

ord1

dwrite

DWriteCreateFactory

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

winmm

timeEndPeriod timeBeginPeriod

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentStringsW FreeEnvironmentStringsW GetCurrentDirectoryA GetEnvironmentVariableA ExpandEnvironmentStringsA

api-ms-win-core-file-l1-1-0

FindFirstFileA DeleteFileA CreateFileA GetFileSize GetFileSizeEx ReadFile WriteFile FindNextFileA CreateDirectoryA CreateFileW DeleteFileW GetTempFileNameW GetFileAttributesA FindClose

api-ms-win-core-file-l1-2-2

GetTempPathA

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter QueryPerformanceFrequency

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW Sleep WakeAllConditionVariable

api-ms-win-core-processthreads-l1-1-0

GetStartupInfoW GetCurrentProcessId GetCurrentThreadId GetExitCodeProcess

api-ms-win-core-processthreads-l1-1-1

OpenProcess FlushInstructionCache

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime GetSystemInfo GetTickCount

api-ms-win-core-memory-l1-1-0

WriteProcessMemory VirtualQueryEx ReadProcessMemory VirtualAllocEx VirtualProtectEx VirtualFreeEx

api-ms-win-core-libraryloader-l1-2-0

SizeofResource LockResource LoadLibraryExW FreeLibrary GetProcAddress LoadResource GetModuleFileNameA GetModuleHandleA GetModuleHandleW

api-ms-win-core-libraryloader-l1-2-1

FindResourceW LoadLibraryA

api-ms-win-core-heap-l2-1-0

GlobalAlloc GlobalFree

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock GlobalLock

api-ms-win-core-psapi-ansi-l1-1-0

QueryFullProcessImageNameA

api-ms-win-core-toolhelp-l1-1-0

CreateToolhelp32Snapshot Process32FirstW Process32NextW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar WideCharToMultiByte

d3d11

D3D11CreateDevice

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe SetNamedPipeHandleState

ws2_32

WSAStartup

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive CreateEventW SetEvent ReleaseSRWLockExclusive WaitForSingleObject CreateEventA

d3d12

D3D12SerializeRootSignature ord101

dxgi

CreateDXGIFactory1

d3dcompiler_47

D3DCompile

shell32

SHGetFolderPathA ShellExecuteA

opengl32

glPixelStorei glIsEnabled glGetIntegerv glGenTextures glEnable glDisable glTexImage2D glBindTexture glViewport glClearColor glClear wglMakeCurrent wglGetProcAddress wglDeleteContext wglCreateContext glTexParameteri glTexSubImage2D glDeleteTextures

kernel32

Module32NextW Module32FirstW lstrcpynA

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exceptions@std@@YAHXZ _Query_perf_counter _Query_perf_frequency _Thrd_detach _Mtx_lock _Mtx_unlock _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??7ios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ??Bios_base@std@@QEBA_NXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Xbad_function_call@std@@YAXXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ?id@?$ctype@D@std@@2V0locale@2@A ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z ?_Xinvalid_argument@std@@YAXPEBD@Z _Thrd_id _Thrd_join ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

vcruntime140

__std_terminate __std_exception_copy __std_exception_destroy _CxxThrowException memcmp memcpy memmove memset __current_exception_context __current_exception __C_specific_handler strstr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strncpy_s wcslen _wcsicmp iswspace strncmp strlen strcmp strpbrk strnlen _strnicmp _stricmp strncat_s

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode _callnewh free

api-ms-win-crt-convert-l1-1-0

atof strtod atoi _strtoui64

api-ms-win-crt-stdio-l1-1-0

fopen_s __stdio_common_vsprintf_s fclose __p__commode fflush fgetc fgetpos _get_stream_buffer_pointers fputc __stdio_common_vsprintf __stdio_common_vfprintf fputs fread ungetc _set_fmode setvbuf fwrite _fseeki64 fsetpos

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-runtime-l1-1-0

_beginthreadex terminate _set_app_type _get_narrow_winmain_command_line _cexit _initterm _initterm_e _crt_atexit exit _exit _c_exit _register_thread_local_exe_atexit_callback _invalid_parameter_noinfo _errno abort _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_exe

api-ms-win-crt-math-l1-1-0

cosf powf fmod __setusermatherr sqrtf ceilf expf sinf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-core-errorhandling-l1-1-0

GetLastError SetUnhandledExceptionFilter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead InterlockedPushEntrySList

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

oleaut32

SysStringLen SetErrorInfo SysFreeString GetErrorInfo

api-ms-win-core-heap-l1-1-0

HeapFree GetProcessHeap HeapAlloc