CFXCartel[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
CFXCartel.exe
Size 4.4MB
Sample261102-3d871azy5p
SHA256 c7ade617647473ba87c702a4230f8b083bd27d97c6ff947bde4d6a58f62b6ac1
MD5 1b10856ed3abefdbfce413a9143fddc0
SHA1 bd81ef8874d07cc3cfceb6a8a2410df9d688e5b1
SHA512 52a4896c1fe639d933207117b712ceea94878d989e3e035a1c4a3cbf04a33745a30b4b2921ffe103776f67eef91797c5df7dff3181ae60b03c727ad38e83443c
SSDEEP 49152:nwfNRbl9lRZY2hcnrZ/hRA5lYrXDEnCDuEFo2Hko+uudYl1vHsOf:kmd/hRHx9W2x
TLSH
T128269E83B3ED8989E0176A384752970BE3717834075583DBBF85496ADEAF4E0CB76B40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CFXCartel.exe

File Explorer

CFXCartel.exe

.exe 4.4MB

CFXCartel.exe

IMPHASH f1ccb03f65d4267c2712a1060e7293c1
SHA256 c7ade617647473ba87c702a4230f8b083bd27d97c6ff947bde4d6a58f62b6ac1
MD5 1b10856ed3abefdbfce413a9143fddc0
SHA1 bd81ef8874d07cc3cfceb6a8a2410df9d688e5b1
SHA512 52a4896c1fe639d933207117b712ceea94878d989e3e035a1c4a3cbf04a33745a30b4b2921ffe103776f67eef91797c5df7dff3181ae60b03c727ad38e83443c
SSDEEP 49152:nwfNRbl9lRZY2hcnrZ/hRA5lYrXDEnCDuEFo2Hko+uudYl1vHsOf:kmd/hRHx9W2x
TLSH
T128269E83B3ED8989E0176A384752970BE3717834075583DBBF85496ADEAF4E0CB76B40
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1270144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Users\XdX\Desktop\CFXCartel-main\CFXCartel\build\CFXCartel.pdb

d3d11

D3D11CreateDevice

d3dcompiler_47

D3DCompile

dcomp

DCompositionCreateDevice

dwmapi

DwmExtendFrameIntoClientArea

winhttp

WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpSendRequest WinHttpConnect

kernel32

GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc GetTimeZoneInformation ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetConsoleTitleW OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle Module32FirstW ReadProcessMemory GetModuleFileNameA GetEnvironmentVariableA MultiByteToWideChar WriteProcessMemory SetThreadPriority WaitForSingleObject Sleep GetTickCount64 GetCurrentThread CreateThread SetLastError GetModuleHandleA LoadLibraryA GetSystemInfo VirtualProtectEx GetProcAddress VirtualAllocEx GetModuleHandleW FlushInstructionCache WideCharToMultiByte Module32NextW VirtualFreeEx VirtualQueryEx Thread32Next Thread32First GetLastError GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetLocaleInfoA QueryPerformanceFrequency FreeLibrary QueryPerformanceCounter SetFilePointerEx GetFileSizeEx CreateProcessW GetExitCodeProcess GetFileType FreeEnvironmentStringsW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW VirtualProtect HeapFree HeapAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetCommandLineW GetCommandLineA WriteFile GetStdHandle GetModuleFileNameW TerminateProcess ExitProcess GetCurrentProcess IsProcessorFeaturePresent ReadFile GetModuleHandleExW FreeLibraryAndExitThread ExitThread RtlUnwind FlsFree FlsSetValue FlsGetValue FlsAlloc RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection WakeAllConditionVariable GetLocaleInfoEx SetEnvironmentVariableW GetProcessHeap SetEndOfFile LocalFree SetStdHandle CreateFileW HeapSize WriteConsoleW EnumSystemLocalesW ReleaseSRWLockExclusive AcquireSRWLockExclusive GetCurrentThreadId SleepConditionVariableSRW WaitForSingleObjectEx GetExitCodeThread FormatMessageA CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW CreateFile2 AreFileApisANSI GetFileInformationByHandleEx

user32

GetMessageExtraInfo GetCapture TrackMouseEvent GetKeyboardLayout LoadCursorW SetCursor IsWindowUnicode GetKeyState OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData SetCapture ReleaseCapture GetWindowLongW GetWindowThreadProcessId DefWindowProcW PostMessageW GetWindowRect DestroyWindow IsWindowVisible SetWindowPos CreateWindowExW CallNextHookEx UnregisterClassW RegisterClassExW DispatchMessageW GetCursorInfo PeekMessageW GetWindowTextA GetClipCursor SetWindowDisplayAffinity UnhookWindowsHookEx EnumWindows SetLayeredWindowAttributes TranslateMessage ClipCursor EnumThreadWindows SetWindowsHookExW SetWindowLongW PostQuitMessage UpdateWindow SetForegroundWindow IsIconic EnumDisplaySettingsA GetSystemMetrics ClientToScreen GetClassNameW SetCursorPos ScreenToClient IsWindow GetAsyncKeyState GetClientRect GetCursorPos SendInput GetForegroundWindow ShowWindow MsgWaitForMultipleObjectsEx

shell32

ShellExecuteW

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

495KB

Virtual Size

495KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

66KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

CFXCartel.exe

d3d11

d3dcompiler_47

dcomp

dwmapi

winhttp

kernel32

user32

shell32

imm32

generic