ofx[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ofx.exe
Size 515KB
Sample261025-sfwpkshc45
SHA256 78aef5fa0e1c3e24014df83d228034c2939c2823f757fe09a6d3fa59b751030b
MD5 0f0e6f0341e19ae3cb2b2105e0c006b3
SHA1 86a4b4f421835600ae37ee62c21c8350fe45ae9f
SHA512 a8ac915d9cc2df8513055477a00550eb02d9346072b239dc20ca7bd91ab522b9a550bfb236bde1592a57c00a6b723e7f161b33b0c2595f1a3436155f84f4a8ae
SSDEEP 6144:nMqzPTLmgiBwQkxcCYgTcZ7a+hJ7ClfoAHFGZDTwnYkWNpCYKiNYPBksmb/gFlZn:n7zl+kJ7ynQhc/h7+RbBuePz/
TLSH
T13AB48D65A6A807FDD173D1B8DE625902E732788A0331AEDB038059B61F276D58F3FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ofx.exe

File Explorer

ofx.exe

.exe 515KB

ofx.exe

IMPHASH 99c4dee83e33ebbfe6824aa35b36f578
SHA256 78aef5fa0e1c3e24014df83d228034c2939c2823f757fe09a6d3fa59b751030b
MD5 0f0e6f0341e19ae3cb2b2105e0c006b3
SHA1 86a4b4f421835600ae37ee62c21c8350fe45ae9f
SHA512 a8ac915d9cc2df8513055477a00550eb02d9346072b239dc20ca7bd91ab522b9a550bfb236bde1592a57c00a6b723e7f161b33b0c2595f1a3436155f84f4a8ae
SSDEEP 6144:nMqzPTLmgiBwQkxcCYgTcZ7a+hJ7ClfoAHFGZDTwnYkWNpCYKiNYPBksmb/gFlZn:n7zl+kJ7ynQhc/h7+RbBuePz/
TLSH
T13AB48D65A6A807FDD173D1B8DE625902E732788A0331AEDB038059B61F276D58F3FB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

221760

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptEncrypt BCryptCreateHash BCryptSetProperty BCryptHashData BCryptImportKeyPair BCryptDestroyHash BCryptFinishHash BCryptGenRandom BCryptOpenAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey

advapi32

RegCloseKey OpenProcessToken FreeSid CheckTokenMembership RegOpenKeyExW RegDeleteValueW RegQueryValueExW RegCreateKeyExW LookupPrivilegeValueW AdjustTokenPrivileges RegSetValueExW AllocateAndInitializeSid GetUserNameA

winhttp

WinHttpSetTimeouts WinHttpConnect WinHttpSendRequest WinHttpQueryDataAvailable WinHttpCloseHandle WinHttpOpenRequest WinHttpReceiveResponse WinHttpReadData WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpOpen

ws2_32

getaddrinfo freeaddrinfo WSAStartup gethostname inet_ntop

gdiplus

GdipSaveImageToStream GdipFree GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipAlloc GdipCloneImage GdiplusStartup

gdi32

DeleteObject DeleteDC CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt

user32

FindWindowW EnumDisplayDevicesW SetClipboardData ExitWindowsEx GetClipboardData GetDC MessageBoxW GetSystemMetrics OpenClipboard CloseClipboard EmptyClipboard LockWorkStation ReleaseDC

shell32

ShellExecuteW SHChangeNotify

ole32

CreateStreamOnHGlobal CLSIDFromString GetHGlobalFromStream

kernel32

GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle GetCommandLineA FlushFileBuffers SetFilePointerEx GetOEMCP GetACP IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW LoadLibraryExW GetFileType HeapFree UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext HeapAlloc GetStdHandle GetConsoleOutputCP GetConsoleMode HeapSize WriteConsoleW HeapReAlloc LoadLibraryA ExitProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime CreateDirectoryW ReadFile SizeofResource GetLogicalDrives FindFirstFileW GetFileSizeEx SetHandleInformation FindFirstFileExW VirtualProtect FindNextFileW GetCurrentProcess WriteFile VirtualAlloc TerminateProcess GetModuleFileNameW CreatePipe GetEnvironmentVariableW GetTempPathW CreateMutexW FindClose WaitForSingleObject CreateFileW GetFileAttributesW OpenProcess CreateToolhelp32Snapshot CreateEventW MultiByteToWideChar Sleep GetTickCount64 GetLastError Process32NextW GetDiskFreeSpaceExW GetCurrentThread LockResource GlobalAlloc DeleteFileW Process32FirstW CloseHandle GetSystemInfo ResetEvent LoadResource FindResourceW GetThreadContext GetProcAddress GlobalLock GetCurrentProcessId GlobalMemoryStatusEx CreateProcessW GetModuleHandleW CopyFileW FlushInstructionCache WideCharToMultiByte GlobalUnlock GetDriveTypeW GetComputerNameA CheckRemoteDebuggerPresent WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread GetLogicalProcessorInformationEx ReleaseSRWLockExclusive AcquireSRWLockExclusive QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW

Name

.a1

Size

364KB

Virtual Size

363KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.a2

Size

104KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.a3

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.a4

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.aa

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.a5

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.a6

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ofx.exe

bcrypt

advapi32

winhttp

ws2_32

gdiplus

gdi32

user32

shell32

ole32

kernel32

generic