ofx[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ofx.exe
Size 598KB
Sample261026-w7pbcsbf96
SHA256 4e0e894b8619de37422be41f0d8c69eb3aff91edd11b9936c68a4e2b858e3473
MD5 28cda0b986a39fd2029b5e7bf868ebbc
SHA1 db8fa17044262cf561239413bb3e3fa95b978bff
SHA512 2bb273b79ba29729f17b9d161fdf3443160ba0821bf1b9d43cc0990cae5f709301eb6b4938c4ebcc753e1e86952b901fc66da0dbc13f11ff625612e7977bf101
SSDEEP 6144:tejLw5RpuU/51+5nGUawXH55DChODlrFUUWFkr+VUXnsnh4B5YJjHG8+jvVRmFqp:LAVSenZX7gsBADN7SxPBoHmk
TLSH
T114D46C219A9401FCE177E2B4EE675812F776784A1331ADDB038059A71F27AD48F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ofx.exe

File Explorer

ofx.exe

.exe 598KB

ofx.exe

IMPHASH c415360e081f26b8a7ec47ad2222a309
SHA256 4e0e894b8619de37422be41f0d8c69eb3aff91edd11b9936c68a4e2b858e3473
MD5 28cda0b986a39fd2029b5e7bf868ebbc
SHA1 db8fa17044262cf561239413bb3e3fa95b978bff
SHA512 2bb273b79ba29729f17b9d161fdf3443160ba0821bf1b9d43cc0990cae5f709301eb6b4938c4ebcc753e1e86952b901fc66da0dbc13f11ff625612e7977bf101
SSDEEP 6144:tejLw5RpuU/51+5nGUawXH55DChODlrFUUWFkr+VUXnsnh4B5YJjHG8+jvVRmFqp:LAVSenZX7gsBADN7SxPBoHmk
TLSH
T114D46C219A9401FCE177E2B4EE675812F776784A1331ADDB038059A71F27AD48F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

304800

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptDecrypt BCryptDestroyKey BCryptEncrypt BCryptOpenAlgorithmProvider BCryptGenRandom BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptImportKeyPair BCryptHashData BCryptSetProperty BCryptFinishHash BCryptCreateHash BCryptGenerateSymmetricKey

advapi32

RegCloseKey RegQueryValueExW GetTokenInformation RegOpenKeyExW OpenProcessToken RegSetValueExW RegCreateKeyExW GetUserNameA RegDeleteValueW

iphlpapi

GetAdaptersAddresses

gdiplus

GdipSetSmoothingMode GdipSetStringFormatLineAlign GdipCreateFont GdipCreateSolidFill GdipGraphicsClear GdipFillRectangle GdipFree GdipDrawString GdipSetTextRenderingHint GdipCloneBrush GdipGetImageGraphicsContext GdipDeleteGraphics GdipDeleteStringFormat GdipDeleteFont GdipSaveImageToStream GdipCreateBitmapFromScan0 GdipSetStringFormatAlign GdipSaveImageToFile GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipAlloc GdipCloneImage GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateStringFormat GdiplusStartup GdipDeleteBrush

gdi32

DeleteObject DeleteDC CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt

user32

SetClipboardData SystemParametersInfoW GetDC EnumDisplayDevicesW FindWindowW GetLastInputInfo SendMessageTimeoutW ReleaseDC MessageBoxW GetSystemMetrics OpenClipboard CloseClipboard EmptyClipboard GetClipboardData

shell32

ShellExecuteW ShellExecuteExW SHChangeNotify

ole32

CreateStreamOnHGlobal CLSIDFromString GetHGlobalFromStream

kernel32

FreeEnvironmentStringsW GetProcessHeap GetEnvironmentStringsW GetCommandLineW GetCommandLineA HeapReAlloc SetFilePointerEx GetOEMCP SetStdHandle IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW LoadLibraryExW GetFileType HeapFree UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext HeapAlloc GetStdHandle TerminateProcess ExitProcess IsProcessorFeaturePresent GetConsoleOutputCP GetConsoleMode HeapSize WriteConsoleW GetACP GlobalAlloc GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo GetStringTypeW CreateDirectoryW ReadFile SizeofResource GetLogicalDrives FindFirstFileW GetFileSizeEx SetHandleInformation FindFirstFileExW VirtualProtect FindNextFileW GetCurrentProcess WriteFile VirtualAlloc GetModuleFileNameW CreatePipe GetEnvironmentVariableW GetTempPathW CreateMutexW FindClose WaitForSingleObject CreateFileW GetFileAttributesW GetSystemDirectoryW SetFileAttributesW CreateToolhelp32Snapshot CreateEventW MultiByteToWideChar Sleep GetTickCount64 GetLastError Process32NextW GetDiskFreeSpaceExW GetCurrentThread LockResource DeleteFileW Process32FirstW CloseHandle GetSystemInfo LoadLibraryW ResetEvent LoadResource FindResourceW GetThreadContext GetWindowsDirectoryW VirtualLock GetProcAddress GlobalLock LocalFree MoveFileExW GetCurrentProcessId GlobalMemoryStatusEx CreateProcessW GetModuleHandleW CopyFileW FlushInstructionCache WideCharToMultiByte GetSystemTimeAsFileTime GetTickCount GlobalUnlock GetDriveTypeW GetComputerNameA CheckRemoteDebuggerPresent FlushFileBuffers WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread GetLogicalProcessorInformationEx ReleaseSRWLockExclusive AcquireSRWLockExclusive QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx

Name

.text

Size

449KB

Virtual Size

448KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

110KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ofx.exe

bcrypt

advapi32

iphlpapi

gdiplus

gdi32

user32

shell32

ole32

kernel32

generic