ModernFixes[.]asi | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ModernFixes.asi
Size 3.3MB
Sample261018-14zedabs4v
SHA256 b454d09342175b8016c8d4c4c10302a2ec279a5b9a990b0ca94d0f0a081b228f
MD5 3aa886c4cbcab173588388c9eba695fa
SHA1 f61054eaefafbbcac2f4367c08752c126a6f9dc8
SHA512 3436e025eb6f07fd26836d2fb399bd48e6449548307469aced5feef9dc95dcf7fdd06830d8b2e5de174d289a9b38003aa340093721b398882a26d1897c2e91ca
SSDEEP 49152:5ES7ONdyEJRBj7NsX3OXXN8F1RxLi7gr/2b8UoEzbbmHZcNZD/gP5:5EVNdr7mHsuF1RYsqLoEzOCZD8
TLSH
T1A3F5DF43F68BE9DAD492133581D79BBB5734BE248616D7A7FB4DB433A933AC06C42201
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ModernFixes.asi

File Explorer

ModernFixes.asi

.dll 3.3MB

ModernFixes.asi

IMPHASH 818e859a0785cb17f227ce485e67ecb3
SHA256 b454d09342175b8016c8d4c4c10302a2ec279a5b9a990b0ca94d0f0a081b228f
MD5 3aa886c4cbcab173588388c9eba695fa
SHA1 f61054eaefafbbcac2f4367c08752c126a6f9dc8
SHA512 3436e025eb6f07fd26836d2fb399bd48e6449548307469aced5feef9dc95dcf7fdd06830d8b2e5de174d289a9b38003aa340093721b398882a26d1897c2e91ca
SSDEEP 49152:5ES7ONdyEJRBj7NsX3OXXN8F1RxLi7gr/2b8UoEzbbmHZcNZD/gP5:5EVNdr7mHsuF1RYsqLoEzOCZD8
TLSH
T1A3F5DF43F68BE9DAD492133581D79BBB5734BE248616D7A7FB4DB433A933AC06C42201
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5040

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegCreateKeyExW RegEnumKeyExA RegOpenKeyExA RegQueryValueExA RegQueryValueExW RegSetValueExW

gdi32

AddFontMemResourceEx BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateDIBSection CreateFontW CreatePen DeleteDC DeleteObject GdiAlphaBlend GdiFlush GetCharABCWidthsW GetStockObject GetTextExtentPoint32W GetTextMetricsW LineTo MoveToEx SelectObject SetBkMode SetTextAlign SetTextCharacterExtra SetTextColor TextOutW

kernel32

CloseHandle CopyFileA CreateDirectoryA CreateEventA CreateFileA CreateMutexA CreateProcessA CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteCriticalSection DeleteFileA DisableThreadLibraryCalls EnterCriticalSection FindClose FindFirstFileA FindNextFileA FlushInstructionCache FreeLibrary GetCommandLineA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableA GetExitCodeProcess GetFileAttributesA GetFileAttributesExA GetFileSize GetLastError GetLocalTime GetLogicalProcessorInformationEx GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleW GetNativeSystemInfo GetPrivateProfileIntA GetPrivateProfileStringA GetProcAddress GetProcessAffinityMask GetSystemInfo GetSystemTimeAsFileTime GetThreadId GetTickCount GetWindowsDirectoryA GlobalMemoryStatusEx InitializeConditionVariable InitializeCriticalSection IsBadReadPtr IsBadWritePtr IsDBCSLeadByteEx IsWow64Process LeaveCriticalSection LoadLibraryA LoadLibraryW Module32First Module32Next MoveFileExA MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency ReadFile ReadProcessMemory SetEnvironmentVariableA SetEvent SetLastError SetProcessAffinityMask SetThreadExecutionState SetThreadPriority SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepConditionVariableCS TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection VirtualAlloc VirtualProtect VirtualQuery WaitForSingleObject WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteFile WritePrivateProfileStringA WriteProcessMemory

msvcrt

__mb_cur_max __setusermatherr _amsg_exit _assert _errno _fsopen _initterm _iob _lock _stricmp _strnicmp _unlock _wfopen abort atoi calloc fclose fflush fputc fputs free fwrite getc getenv isspace isxdigit localeconv log10 malloc memchr memcmp memcpy memmove memset realloc setlocale strchr strcmp strerror strlen strncmp strrchr strstr strtol strtoul tolower toupper ungetc vfprintf wcslen _strtoui64 _strtoi64 _read

ole32

CoCreateInstance CoInitializeEx

shell32

SHGetSpecialFolderPathA

user32

AttachThreadInput BeginPaint BringWindowToTop CallWindowProcA ClientToScreen ClipCursor CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW EndPaint EnumDisplayMonitors EnumDisplaySettingsA FillRect FindWindowA GetAsyncKeyState GetClientRect GetCursorPos GetForegroundWindow GetMessageW GetMonitorInfoA GetWindowThreadProcessId InvalidateRect IsIconic MapVirtualKeyA MapWindowPoints MonitorFromPoint MonitorFromRect PostMessageA PostQuitMessage RegisterClassW ScreenToClient SendInput SetActiveWindow SetCursor SetForegroundWindow SetTimer SetWindowLongA SetWindowPos ShowWindow ShowWindowAsync TranslateMessage wsprintfW

winmm

timeBeginPeriod waveOutOpen waveOutPrepareHeader waveOutReset waveOutWrite

ws2_32

WSASetLastError ntohl ntohs

Name

.text

Size

514KB

Virtual Size

514KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

104KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

208KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/14

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/29

Size

115KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/41

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/55

Size

58KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/67

Size

1024B

Virtual Size

977B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/78

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/94

Size

70KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/110

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ModernFixes.asi

advapi32

gdi32

kernel32

msvcrt

ole32

shell32

user32

winmm

ws2_32

generic