ofx[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ofx.exe
Size 591KB
Sample261026-vmncwsft21
SHA256 f5a513261dc00ac50fbb0320939710b91d0e1c6c7102f4b68662867c6e589624
MD5 34b9b9c8af644f4f105f3a90b2eb755c
SHA1 78c69a69a996a67b150dc31dc378bf076d972525
SHA512 b199b355eb82ad652049cf2be56155915e0773382eaf4b24c1a8fc71a479e8e64931b95481b30959b8b56f739712698cacb6b419d3fe6d4279419694c83aa854
SSDEEP 6144:qWep8v5cIlaw8pCLqmhDEYVEqq5Bgq+5aXU5VkG/I0PUawJeG6yuEE1LSIbN5FU+:qIAqtIlejU4JAgbgyx7d4yO8ll
TLSH
T194D46C219A9401FCE273D2B4EEA75812F676784613716DDB038059A71F27AD88F3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ofx.exe

File Explorer

ofx.exe

.exe 591KB

ofx.exe

IMPHASH 10d13c30289928a451d91736bf1141f7
SHA256 f5a513261dc00ac50fbb0320939710b91d0e1c6c7102f4b68662867c6e589624
MD5 34b9b9c8af644f4f105f3a90b2eb755c
SHA1 78c69a69a996a67b150dc31dc378bf076d972525
SHA512 b199b355eb82ad652049cf2be56155915e0773382eaf4b24c1a8fc71a479e8e64931b95481b30959b8b56f739712698cacb6b419d3fe6d4279419694c83aa854
SSDEEP 6144:qWep8v5cIlaw8pCLqmhDEYVEqq5Bgq+5aXU5VkG/I0PUawJeG6yuEE1LSIbN5FU+:qIAqtIlejU4JAgbgyx7d4yO8ll
TLSH
T194D46C219A9401FCE273D2B4EEA75812F676784613716DDB038059A71F27AD88F3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

299808

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptDecrypt BCryptDestroyKey BCryptEncrypt BCryptOpenAlgorithmProvider BCryptGenRandom BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptImportKeyPair BCryptHashData BCryptSetProperty BCryptCreateHash BCryptFinishHash BCryptGenerateSymmetricKey

advapi32

RegCloseKey RegQueryValueExW GetTokenInformation RegOpenKeyExW OpenProcessToken RegSetValueExW RegCreateKeyExW GetUserNameA RegDeleteValueW

iphlpapi

GetAdaptersAddresses

gdiplus

GdipSetSmoothingMode GdipSetStringFormatLineAlign GdipCreateFont GdipCreateSolidFill GdipGraphicsClear GdipFillRectangle GdipFree GdipDrawString GdipSetTextRenderingHint GdipCloneBrush GdipGetImageGraphicsContext GdipDeleteGraphics GdipDeleteStringFormat GdipDeleteFont GdipSaveImageToStream GdipCreateBitmapFromScan0 GdipSetStringFormatAlign GdipSaveImageToFile GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipDeleteBrush GdipCloneImage GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateStringFormat GdiplusStartup GdipAlloc

gdi32

DeleteObject DeleteDC CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt

user32

SetClipboardData SystemParametersInfoW GetDC EnumDisplayDevicesW FindWindowW GetLastInputInfo ReleaseDC MessageBoxW GetSystemMetrics OpenClipboard CloseClipboard EmptyClipboard GetClipboardData

shell32

ShellExecuteExW ShellExecuteW SHChangeNotify

ole32

CreateStreamOnHGlobal CLSIDFromString GetHGlobalFromStream

kernel32

FreeEnvironmentStringsW GetProcessHeap GetEnvironmentStringsW GetCommandLineW GetCommandLineA HeapReAlloc SetFilePointerEx GetOEMCP SetStdHandle IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW LoadLibraryExW GetFileType HeapFree UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext HeapAlloc GetStdHandle TerminateProcess ExitProcess IsProcessorFeaturePresent GetConsoleOutputCP GetConsoleMode HeapSize WriteConsoleW GetACP DeleteFileW GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo CreateDirectoryW ReadFile SizeofResource GetLogicalDrives FindFirstFileW GetFileSizeEx SetHandleInformation FindFirstFileExW VirtualProtect FindNextFileW GetCurrentProcess WriteFile VirtualAlloc GetModuleFileNameW CreatePipe GetEnvironmentVariableW GetTempPathW CreateMutexW FindClose WaitForSingleObject CreateFileW GetFileAttributesW GetSystemDirectoryW SetFileAttributesW CreateToolhelp32Snapshot CreateEventW MultiByteToWideChar Sleep GetTickCount64 GetLastError Process32NextW GetDiskFreeSpaceExW GetCurrentThread LockResource GlobalAlloc Process32FirstW CloseHandle GetSystemInfo LoadLibraryW ResetEvent LoadResource FindResourceW GetThreadContext GetWindowsDirectoryW VirtualLock GetProcAddress GlobalLock LocalFree MoveFileExW GetCurrentProcessId GlobalMemoryStatusEx CreateProcessW GetModuleHandleW CopyFileW FlushInstructionCache WideCharToMultiByte GetSystemTimeAsFileTime GetTickCount GlobalUnlock GetDriveTypeW GetComputerNameA CheckRemoteDebuggerPresent FlushFileBuffers WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread GetLogicalProcessorInformationEx ReleaseSRWLockExclusive AcquireSRWLockExclusive QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW

Name

.text

Size

443KB

Virtual Size

443KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

110KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ofx.exe

bcrypt

advapi32

iphlpapi

gdiplus

gdi32

user32

shell32

ole32

kernel32

generic