fivemgaid[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
fivemgaid.exe
Size 194KB
Sample261026-3ba77ahs4y
SHA256 695abf407f65bd114f3fae83f578cbccd6fa3d0ca861f3b271df4533e6868ab4
MD5 c9a42a3f0f52d4aafb8e0956235ecbf1
SHA1 393d347026064f6ea4c030abcf62c2fb51c0d358
SHA512 23ac367d90a7a9cb54d9decd4f5e5da64f20d5d286d5b9a6fe2280f511ade50d671b5fc5ad0d1c7ed7118d3fc64e149318d15063551c0d809a1967eba18329ed
SSDEEP 3072:2o+o7rAZyIqVi3VsDo5AXvniGsCRyBOh9W6BJNLc5a+1tJ5E6OKwuaTLSMHHJfHe:2FZ0pDo5AXvnB74lleU
TLSH
T19F1498512ADB4CAADCD13BB875C7A239973DFDA1CE6A071BD244C0201913AC57EBE781
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fivemgaid.exe

File Explorer

fivemgaid.exe

.exe 194KB

fivemgaid.exe

IMPHASH fd15a0e8b397c63b880ade6401b6b583
SHA256 695abf407f65bd114f3fae83f578cbccd6fa3d0ca861f3b271df4533e6868ab4
MD5 c9a42a3f0f52d4aafb8e0956235ecbf1
SHA1 393d347026064f6ea4c030abcf62c2fb51c0d358
SHA512 23ac367d90a7a9cb54d9decd4f5e5da64f20d5d286d5b9a6fe2280f511ade50d671b5fc5ad0d1c7ed7118d3fc64e149318d15063551c0d809a1967eba18329ed
SSDEEP 3072:2o+o7rAZyIqVi3VsDo5AXvniGsCRyBOh9W6BJNLc5a+1tJ5E6OKwuaTLSMHHJfHe:2FZ0pDo5AXvnB74lleU
TLSH
T19F1498512ADB4CAADCD13BB875C7A239973DFDA1CE6A071BD244C0201913AC57EBE781
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4191

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

libgcc_s_seh-1

_Unwind_Resume

libstdc++-6

_ZNKSt10filesystem7__cxx114path5_List13_Impl_deleterclEPNS2_5_ImplE _ZNSi3getEv _ZNSolsEi _ZNSt10filesystem10remove_allERKNS_7__cxx114pathERSt10error_code _ZNSt10filesystem6removeERKNS_7__cxx114pathERSt10error_code _ZNSt10filesystem6statusERKNS_7__cxx114pathERSt10error_code _ZNSt10filesystem7__cxx114path14_M_split_cmptsEv _ZNSt10filesystem7__cxx114path5_ListC1Ev _ZNSt13random_device7_M_finiEv _ZNSt13random_device7_M_initERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE _ZNSt13random_device9_M_getvalEv _ZNSt3_V215system_categoryEv _ZSt17__throw_bad_allocv _ZSt19__throw_logic_errorPKc _ZSt20__throw_length_errorPKc _ZSt21__glibcxx_assert_failPKciS0_S0_ _ZSt24__throw_out_of_range_fmtPKcz _ZSt28__throw_bad_array_new_lengthv _ZSt3cin _ZSt4cout _ZSt5wcout _ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc _ZStlsIcSt11char_traitsIcESaIcEERSt13basic_ostreamIT_T0_ES7_RKNSt7__cxx1112basic_stringIS4_S5_T1_EE _ZStlsIwSt11char_traitsIwEERSt13basic_ostreamIT_T0_ES6_PKS3_ _ZStlsIwSt11char_traitsIwESaIwEERSt13basic_ostreamIT_T0_ES7_RKNSt7__cxx1112basic_stringIS4_S5_T1_EE _ZdlPvy _Znwy __gxx_personality_seh0

advapi32

GetTokenInformation OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyW RegEnumKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW

kernel32

CloseHandle DeleteCriticalSection EnterCriticalSection FreeLibrary GetCurrentProcess GetLastError GetModuleHandleA GetProcAddress InitializeCriticalSection LeaveCriticalSection LoadLibraryA SetComputerNameExA SetConsoleTitleA SetUnhandledExceptionFilter Sleep TlsGetValue VirtualProtect VirtualQuery

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

__C_specific_handler memcpy memmove

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _cexit _configure_narrow_argv _crt_atexit _exit _initialize_narrow_environment _set_app_type _initterm _initterm_e _set_invalid_parameter_handler abort exit signal system

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf fflush setvbuf

api-ms-win-crt-string-l1-1-0

iswdigit memset strlen strncmp wcslen

shell32

SHGetFolderPathW

Name

.text

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

192B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

116B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/14

Size

512B

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/29

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/41

Size

512B

Virtual Size

202B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/55

Size

512B

Virtual Size

164B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/67

Size

512B

Virtual Size

72B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/80

Size

512B

Virtual Size

126B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/91

Size

512B

Virtual Size

378B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

fivemgaid.exe

libgcc_s_seh-1

libstdc++-6

advapi32

kernel32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

shell32

generic