ofx[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ofx.exe
Size 561KB
Sample261026-tskzaaxxc1
SHA256 077b7dfa09267418c1896cb6ca8bb9212f76918cac7b8ee4699fa06c9b32c969
MD5 64a6a5ecef2493e00fa7dc6ae53f56fb
SHA1 4cd465f8ea9d79ece5b911023755c77917bac05f
SHA512 29a6dd249b3814f59c6e48276de151c336a97efe3d44fc743d6e5d0e79b277afbaa569cc0e79f9e1075ee473f3a54cb4aae0eb65e4afc4461eb00f0879d3c6b0
SSDEEP 6144:U4eGdv5VSuRZ2Y5HtHIcX8XoikeuCFTcwP1zgQW5HeI0dp9FA2ZGBVmXNd/oIEmS:UljnZA0Q5+5/v/bAwYQicL4k
TLSH
T184C46C219AA402FDE273D1B4DE665802FA72784A1331ADDB039059B71F27AD48F3FB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ofx.exe

File Explorer

ofx.exe

.exe 561KB

ofx.exe

IMPHASH c9a43f39e8427a99bd115890d14b5677
SHA256 077b7dfa09267418c1896cb6ca8bb9212f76918cac7b8ee4699fa06c9b32c969
MD5 64a6a5ecef2493e00fa7dc6ae53f56fb
SHA1 4cd465f8ea9d79ece5b911023755c77917bac05f
SHA512 29a6dd249b3814f59c6e48276de151c336a97efe3d44fc743d6e5d0e79b277afbaa569cc0e79f9e1075ee473f3a54cb4aae0eb65e4afc4461eb00f0879d3c6b0
SSDEEP 6144:U4eGdv5VSuRZ2Y5HtHIcX8XoikeuCFTcwP1zgQW5HeI0dp9FA2ZGBVmXNd/oIEmS:UljnZA0Q5+5/v/bAwYQicL4k
TLSH
T184C46C219AA402FDE273D1B4DE665802FA72784A1331ADDB039059B71F27AD48F3FB51
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

276016

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptDecrypt BCryptDestroyKey BCryptOpenAlgorithmProvider BCryptGenRandom BCryptEncrypt BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptImportKeyPair BCryptHashData BCryptSetProperty BCryptCreateHash BCryptGenerateSymmetricKey

advapi32

RegCreateKeyExW RegQueryValueExW GetTokenInformation RegOpenKeyExW OpenProcessToken RegSetValueExW GetUserNameA RegCloseKey RegDeleteValueW

iphlpapi

GetAdaptersAddresses

gdiplus

GdipSaveImageToStream GdipFree GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipAlloc GdipCloneImage GdiplusStartup

gdi32

DeleteDC DeleteObject SelectObject CreateCompatibleBitmap BitBlt CreateCompatibleDC

user32

EnumDisplayDevicesW SetClipboardData GetClipboardData FindWindowW EmptyClipboard GetLastInputInfo GetDC MessageBoxW GetSystemMetrics OpenClipboard CloseClipboard ReleaseDC

shell32

ShellExecuteW ShellExecuteExW SHChangeNotify

ole32

CLSIDFromString CreateStreamOnHGlobal GetHGlobalFromStream

kernel32

GetProcessHeap SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA HeapReAlloc SetFilePointerEx GetOEMCP GetACP IsValidCodePage FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize WriteConsoleW GlobalLock EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW LoadLibraryExW GetFileType HeapFree UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext HeapAlloc GetStdHandle TerminateProcess ExitProcess IsProcessorFeaturePresent CreateDirectoryW ReadFile SizeofResource GetLogicalDrives FindFirstFileW GetFileSizeEx SetHandleInformation FindFirstFileExW VirtualProtect FindNextFileW GetCurrentProcess WriteFile VirtualAlloc GetModuleFileNameW CreatePipe GetEnvironmentVariableW GetTempPathW CreateMutexW FindClose WaitForSingleObject CreateFileW GetFileAttributesW GetSystemDirectoryW CreateToolhelp32Snapshot CreateEventW MultiByteToWideChar Sleep GetTickCount64 GetLastError Process32NextW GetDiskFreeSpaceExW GetCurrentThread LockResource GlobalAlloc DeleteFileW Process32FirstW CloseHandle GetSystemInfo LoadLibraryW ResetEvent LoadResource FindResourceW GetThreadContext GetProcAddress LocalFree MoveFileExW GetCurrentProcessId GlobalMemoryStatusEx CreateProcessW GetModuleHandleW CopyFileW FlushInstructionCache WideCharToMultiByte GetTickCount GlobalUnlock GetDriveTypeW GetComputerNameA CheckRemoteDebuggerPresent WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread GetLogicalProcessorInformationEx ReleaseSRWLockExclusive AcquireSRWLockExclusive QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead GetModuleHandleExW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread

Name

.text

Size

419KB

Virtual Size

418KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

105KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ofx.exe

bcrypt

advapi32

iphlpapi

gdiplus

gdi32

user32

shell32

ole32

kernel32

generic