Fivem[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Fivem.exe
Size 10.9MB
Sample261027-v26ssaeb58
SHA256 c5d341cba03961054a2ea752725d3d6d899f6cb6dbadc64740bc3991be7351ca
MD5 ce6d34339b66fc03ae6533427216c580
SHA1 9823f34da9bfeb6bd56cea2b362fa273a298e4b8
SHA512 8ef4cb20611a65b65498d28fda0410d55ebafc76e0ff3eace67c6c74b42c14a3a546c1bc5f934899093250b9b8f3a790247fb61a7236be40eeed91c0e7530e49
SSDEEP 196608:IjE27YBCF/AbEepRxoJua7BIDmg/Htumr3U/3qKySMkHG7Fo+tkLS3/hysMkAmMx:IAYobEkohIDmonw6KySJHGBo+bPQsMQI
TLSH
T131B61255A22900ACDF7AD1F0891A954FD5793CCC8BA57FDB920C6A512B933FC1A3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Fivem.exe

File Explorer

Fivem.exe

.exe 10.9MB

Fivem.exe

IMPHASH 773789df468717a091503603e46c273c
SHA256 c5d341cba03961054a2ea752725d3d6d899f6cb6dbadc64740bc3991be7351ca
MD5 ce6d34339b66fc03ae6533427216c580
SHA1 9823f34da9bfeb6bd56cea2b362fa273a298e4b8
SHA512 8ef4cb20611a65b65498d28fda0410d55ebafc76e0ff3eace67c6c74b42c14a3a546c1bc5f934899093250b9b8f3a790247fb61a7236be40eeed91c0e7530e49
SSDEEP 196608:IjE27YBCF/AbEepRxoJua7BIDmg/Htumr3U/3qKySMkHG7Fo+tkLS3/hysMkAmMx:IAYobEkohIDmonw6KySJHGBo+bPQsMQI
TLSH
T131B61255A22900ACDF7AD1F0891A954FD5793CCC8BA57FDB920C6A512B933FC1A3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1428976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

winhttp

WinHttpSendRequest WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpOpen WinHttpConnect WinHttpQueryDataAvailable WinHttpReceiveResponse

kernel32

GetLocaleInfoA MultiByteToWideChar LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock Beep GetTickCount64 OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle K32GetModuleBaseNameA K32GetModuleInformation ReadProcessMemory K32EnumProcessModules WriteProcessMemory GetModuleHandleW CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA GetOEMCP GetACP IsValidCodePage FindNextFileW GetCommandLineA FindClose GetTimeZoneInformation GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc ReadConsoleW GetConsoleMode SetFilePointerEx GetFileType WriteFile GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwind SetLastError GetLastError RaiseException CreateFileW HeapSize WriteConsoleW FindFirstFileExW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId SetEndOfFile SleepConditionVariableSRW Sleep GetStringTypeW InitializeCriticalSectionEx GetSystemTimeAsFileTime WakeAllConditionVariable EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader

user32

SetCursorPos ReleaseCapture GetCursorPos GetAsyncKeyState IsWindowUnicode DefWindowProcW CreateWindowExW MapWindowPoints MoveWindow SetWindowLongW SetForegroundWindow mouse_event DispatchMessageW PeekMessageW SetWindowDisplayAffinity TranslateMessage GetSystemMetrics SendInput OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect

advapi32

RegQueryValueExW

shell32

ShellExecuteA

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9.2MB

Virtual Size

9.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

66KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Fivem.exe

d3d11

d3dcompiler_43

winhttp

kernel32

user32

advapi32

shell32

d3dx11_43

dwmapi

imm32

generic