FixErro1007[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
FixErro1007.exe
Size 2.1MB
Sample261023-arkscagx2v
SHA256 61ed26c0d625df622efe837d7e79a6a788e6eb953e4b7dc02e3d97f301ce0faa
MD5 b63c029ec21686afde0d12232dedd396
SHA1 25f96b50f6edec85bcf80c5336b2cefde7a69334
SHA512 1c1867f66369936ff92b922038054b101e325581bcd3598448779e14f0892d1496c6791884e525193aabc2c9e350196e108d64c57d869aa23bb1a904155bc852
SSDEEP 49152:N0A7GV2uMI532cgJCqWWttb1fn+Wy1jO/v3VZGU4Ine845kctI:N0XL2WWttb1fn+Wy1jOnH+XWwI
TLSH
T14EA57C5AE6B701F4C5BAD038A543722BF97130594334A7EB9BD04B571BA2BE0A5FE700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FixErro1007.exe

File Explorer

FixErro1007.exe

.exe 2.1MB

FixErro1007.exe

IMPHASH cd42997aeaea8a42b3e2f43d92327fe3
SHA256 61ed26c0d625df622efe837d7e79a6a788e6eb953e4b7dc02e3d97f301ce0faa
MD5 b63c029ec21686afde0d12232dedd396
SHA1 25f96b50f6edec85bcf80c5336b2cefde7a69334
SHA512 1c1867f66369936ff92b922038054b101e325581bcd3598448779e14f0892d1496c6791884e525193aabc2c9e350196e108d64c57d869aa23bb1a904155bc852
SSDEEP 49152:N0A7GV2uMI532cgJCqWWttb1fn+Wy1jO/v3VZGU4Ine845kctI:N0XL2WWttb1fn+Wy1jOnH+XWwI
TLSH
T14EA57C5AE6B701F4C5BAD038A543722BF97130594334A7EB9BD04B571BA2BE0A5FE700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1495632

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

crypt32

CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CryptProtectData CertFreeCertificateChain CryptUnprotectData

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

psapi

GetModuleInformation

kernel32

Process32FirstW CreateThread Module32FirstW ExitProcess GetCurrentProcessId CreateProcessW GetModuleHandleW Module32NextW QueryPerformanceCounter CheckRemoteDebuggerPresent OutputDebugStringA GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA LoadLibraryA IsDBCSLeadByte VerSetConditionMask FreeLibrary CreateFileW AddVectoredExceptionHandler GetCurrentThreadId GetTickCount64 GetSystemDirectoryW VirtualProtect CreateFileMappingW MapViewOfFile UnmapViewOfFile AddDllDirectory SetDefaultDllDirectories QueryFullProcessImageNameW SetDllDirectoryW FormatMessageW ReleaseSRWLockExclusive HeapFree InitializeCriticalSection EnterCriticalSection LeaveCriticalSection LoadLibraryW SleepEx GetSystemInfo CreateFileA GetTickCount MoveFileExW WaitForSingleObjectEx GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW GetFileSizeEx GetProcessHeap GetFileInformationByHandleEx AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx FormatMessageA DeleteCriticalSection HeapDestroy Process32NextW GetExitCodeThread CreateToolhelp32Snapshot CreateMutexW GetModuleFileNameW GetCommandLineW SetLastError ReadFile DeleteFileW HeapAlloc HeapReAlloc QueryPerformanceFrequency GetProcAddress GetModuleHandleA MultiByteToWideChar WideCharToMultiByte OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter GetLastError HeapSize InitializeCriticalSectionEx GetCurrentProcess CloseHandle SetFileAttributesW WaitForSingleObject GetEnvironmentVariableA IsDebuggerPresent LocalFree GetThreadContext GetWindowsDirectoryA GetCurrentThread GetFileAttributesA Sleep GetModuleFileNameA SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive

user32

SetLayeredWindowAttributes GetKeyState GetMessageExtraInfo GetCapture TranslateMessage LoadIconW LoadImageW UpdateWindow EnableWindow IsWindowVisible EnumWindows GetWindowTextW CharLowerW DefWindowProcW PostMessageW GetClientRect LoadCursorA DestroyWindow SetWindowPos SetWindowRgn CreateWindowExW ScreenToClient GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW PeekMessageW MessageBoxA IsWindow SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode SetCursor SetCapture GetWindowRect PostQuitMessage GetForegroundWindow GetKeyboardLayout ClientToScreen TrackMouseEvent

gdi32

CreateRoundRectRgn

advapi32

CryptDestroyKey GetLengthSid OpenProcessToken IsValidSid CopySid ConvertSidToStringSidA CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextA AddAccessAllowedAce InitializeAcl GetUserNameA RegCreateKeyExA RegDeleteKeyA SetSecurityInfo CryptEncrypt CryptImportKey GetTokenInformation SystemFunction036 CryptAcquireContextW

shell32

CommandLineToArgvW ShellExecuteW ShellExecuteA SHGetFolderPathA

ole32

CoInitializeEx CoCreateGuid CoTaskMemFree CoUninitialize

msvcp140

?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?id@?$ctype@D@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Random_device@std@@YAIXZ ?_Xbad_function_call@std@@YAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_detach _Mtx_unlock ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?setf@ios_base@std@@QEAAHHH@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?uncaught_exceptions@std@@YAHXZ _Xtime_get_ticks _Query_perf_counter _Query_perf_frequency ??Bid@locale@std@@QEAA_KXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

ws2_32

setsockopt recv socket WSAIoctl __WSAFDIsSet select accept htonl listen recvfrom sendto ioctlsocket gethostname htons getsockname connect bind getpeername WSAStartup WSASetLastError ntohs WSAGetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt inet_ntop inet_pton freeaddrinfo getaddrinfo ntohl WSACleanup

shlwapi

PathFindFileNameW

userenv

UnloadUserProfile

imm32

ImmReleaseContext ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

wintrust

WinVerifyTrust

dnsapi

DnsQuery_A DnsFree

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __current_exception wcschr strstr strrchr memset memmove memcpy memcmp memchr _CxxThrowException strchr __C_specific_handler wcsstr __std_terminate __std_exception_copy __std_exception_destroy __C_specific_handler_noexcept

api-ms-win-crt-stdio-l1-1-0

_lseeki64 __acrt_iob_func ftell feof _wopen fputc __stdio_common_vfprintf fflush fputs _set_fmode fclose _wfopen __stdio_common_vsprintf fsetpos __p__commode fseek _read _write fread _popen _fileno _close fgetc _pclose ungetc _fseeki64 fgets _get_stream_buffer_pointers __stdio_common_vsscanf setvbuf __stdio_common_vsprintf_s fwrite fgetpos __stdio_common_vswprintf_s

api-ms-win-crt-heap-l1-1-0

free realloc _set_new_mode calloc _recalloc _callnewh malloc

api-ms-win-crt-string-l1-1-0

towlower _stricmp _wcsicmp strcpy_s isspace tolower _strdup _wcsdup strcspn strncpy_s strncmp strcat_s wcspbrk strspn strcmp wcsncmp strpbrk wcsncpy_s isxdigit wcslen strlen strncpy wcsncpy

api-ms-win-crt-runtime-l1-1-0

system __sys_errlist __sys_nerr exit _invalid_parameter_noinfo_noreturn abort _register_thread_local_exe_atexit_callback _c_exit _exit _initterm_e _initterm _get_narrow_winmain_command_line terminate _set_app_type _beginthreadex _seh_filter_exe _errno _cexit _crt_atexit _invalid_parameter_noinfo _resetstkoflw _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function

api-ms-win-crt-filesystem-l1-1-0

_fstat64 _unlock_file _wstat64 _unlink _lock_file

api-ms-win-crt-time-l1-1-0

_localtime64 _gmtime64 strftime _time64

api-ms-win-crt-convert-l1-1-0

wcstombs strtoul strtol strtoull strtoll strtod atoi _wtoi

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

floorf fmodf sinf cosf _dsign __setusermatherr _fdopen expf ceilf acosf sqrtf

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func localeconv _configthreadlocale