fluence[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
fluence.exe
Size 2.1MB
Sample261024-qpre4sh19w
SHA256 2c8010b4938a783df50e0148e4640082f5214b23c11e361c06086fef9b87d86b
MD5 f373fc78211aab2a9af472f80551c56a
SHA1 4de5ebf4625e59858ead6cb472f3b870d30298b4
SHA512 2fdc9cf3b036f56b8f574cfeb5b4e5ec50c2672dad2e54f602c4568b27ce2578ede052f636bd287404a7d3a19ec3a47eb44c017abf14f7854ad8b11cf1fd2151
SSDEEP 24576:vJlElv5I4gJYEBM0x2dXBc6M8ULY8ivnrm:v4lahJ5M9c0vnr
TLSH
T18EA5D72432FA05A1D1A9C079E9079767CD70704A173D52FF939489C56FB03E8AABCB63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fluence.exe

File Explorer

fluence.exe

.exe 2.1MB

fluence.exe

IMPHASH 9325411ee68b35d70f452f2b7f6593b5
SHA256 2c8010b4938a783df50e0148e4640082f5214b23c11e361c06086fef9b87d86b
MD5 f373fc78211aab2a9af472f80551c56a
SHA1 4de5ebf4625e59858ead6cb472f3b870d30298b4
SHA512 2fdc9cf3b036f56b8f574cfeb5b4e5ec50c2672dad2e54f602c4568b27ce2578ede052f636bd287404a7d3a19ec3a47eb44c017abf14f7854ad8b11cf1fd2151
SSDEEP 24576:vJlElv5I4gJYEBM0x2dXBc6M8ULY8ivnrm:v4lahJ5M9c0vnr
TLSH
T18EA5D72432FA05A1D1A9C079E9079767CD70704A173D52FF939489C56FB03E8AABCB63
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

810185

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\!\Desktop\Fluence nigger\room\fluence.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

MultiByteToWideChar GetLocaleInfoA IsDBCSLeadByte OutputDebugStringA GlobalAlloc GlobalUnlock GlobalLock GlobalFree WideCharToMultiByte GetModuleHandleW GetSystemTimes GlobalMemoryStatusEx GetTickCount K32GetPerformanceInfo ReleaseSRWLockExclusive GetProcAddress VerSetConditionMask SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent RaiseException GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime LoadLibraryA GetModuleHandleA FreeLibrary QueryPerformanceFrequency AcquireSRWLockExclusive InitializeSListHead GetLastError HeapAlloc HeapFree QueryPerformanceCounter GetProcessHeap WakeAllConditionVariable VirtualQuery GetCurrentThreadId

user32

UpdateWindow GetSystemMetrics PeekMessageW DispatchMessageW TranslateMessage EmptyClipboard GetAsyncKeyState ShowWindow GetClipboardData SetClipboardData CloseClipboard OpenClipboard SetProcessDPIAware MonitorFromWindow LoadCursorW ScreenToClient ClientToScreen PostQuitMessage CreateWindowExW RegisterClassExW UnregisterClassW GetKeyboardLayout TrackMouseEvent GetMessageExtraInfo DestroyWindow DefWindowProcW GetCursorPos GetKeyState GetCapture SetCapture ReleaseCapture IsWindowUnicode GetForegroundWindow GetDC ReleaseDC GetClientRect SetCursorPos SetCursor

gdi32

GetDeviceCaps CreateRectRgn DeleteObject

shell32

ShellExecuteW

dwmapi

DwmIsCompositionEnabled DwmGetColorizationColor DwmEnableBlurBehindWindow

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

msvcp140d

??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Xlength_error@std@@YAXPEBD@Z

vcruntime140d

__vcrt_GetModuleHandleW __vcrt_GetModuleFileNameW __std_type_info_destroy_list __C_specific_handler_noexcept __current_exception_context __current_exception __C_specific_handler _CxxThrowException __std_exception_destroy __std_exception_copy strchr memmove memchr memset memcpy __vcrt_LoadLibraryExW memcmp

vcruntime140_1d

__CxxFrameHandler4

ucrtbased

_time64 acosf sinf strncmp atof log pow atan2f logf powf floorf _invoke_watson _CrtDbgReport fminf roundf _CrtDbgReportW _callnewh _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _crt_at_quick_exit _cexit terminate _seh_filter_exe _set_app_type __setusermatherr _get_narrow_winmain_command_line sqrtf _initterm_e exit _exit _set_fmode _c_exit _register_thread_local_exe_atexit_callback _configthreadlocale _set_new_mode __p__commode strcpy_s strcat_s __stdio_common_vsprintf_s _free_dbg _wmakepath_s _wsplitpath_s wcscpy_s fmodf __stdio_common_vsscanf __stdio_common_vsprintf __stdio_common_vfprintf fwrite ftell fseek fread fflush fclose _wfopen __acrt_iob_func strncpy strcmp _wassert strlen cosf ceilf fabs _localtime64_s qsort malloc _initterm free

Name

.textbss

Size

Virtual Size

775KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

404KB

Virtual Size

403KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

61KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

fluence.exe

d3d11

d3dcompiler_47

kernel32

user32

gdi32

shell32

dwmapi

imm32

msvcp140d

vcruntime140d

vcruntime140_1d

ucrtbased

generic