SystemFix[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
SystemFix.exe
Size 3.8MB
Sample261102-hldqvafy2w
SHA256 5443928a7d2098008bccd89bcdff03e4a5ad834a9ea8e5ac114f1f15b6a12646
MD5 22eb216bc0770ff01b55e7e502d39b36
SHA1 f8e39597e93ca8b588d2bedfaf406965e51d087b
SHA512 2416ba4edb3c2d72e6f79fb76f8ca75ba6c4d366b240bcb17212aeb25c654931dd262a479ddce8a8782652a2ca97fe6aa4ddf8679b39f5d871b5aa6b214b6415
SSDEEP 49152:EshgJjJeX+EGu/4IMhvTpLRVk3OJKwK3vHEWt1WEbheKuL/9TKlvYP:EJM52htFJKwufsVKuLlwYP
TLSH
T192062338E6E428F5D77BA275895A2B0AD66B3C1387A197DF63C00A672E135D0CF39350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SystemFix.exe

File Explorer

SystemFix.exe

.exe 3.8MB

SystemFix.exe

IMPHASH 7ded604015975929b583962a247d21ca
SHA256 5443928a7d2098008bccd89bcdff03e4a5ad834a9ea8e5ac114f1f15b6a12646
MD5 22eb216bc0770ff01b55e7e502d39b36
SHA1 f8e39597e93ca8b588d2bedfaf406965e51d087b
SHA512 2416ba4edb3c2d72e6f79fb76f8ca75ba6c4d366b240bcb17212aeb25c654931dd262a479ddce8a8782652a2ca97fe6aa4ddf8679b39f5d871b5aa6b214b6415
SSDEEP 49152:EshgJjJeX+EGu/4IMhvTpLRVk3OJKwK3vHEWt1WEbheKuL/9TKlvYP:EJM52htFJKwufsVKuLlwYP
TLSH
T192062338E6E428F5D77BA275895A2B0AD66B3C1387A197DF63C00A672E135D0CF39350
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

97616

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

PostQuitMessage ShowWindow CreateWindowExW DefWindowProcW SendMessageW DispatchMessageW TranslateMessage GetMessageW RegisterClassExW SetCapture SetProcessDPIAware DestroyIcon LoadCursorW GetClassNameA EnumChildWindows WindowFromPoint ScreenToClient MessageBoxW GetWindowTextW SetWindowTextW UpdateWindow TrackPopupMenu AppendMenuW DestroyMenu CreatePopupMenu ReleaseCapture wsprintfW

gdi32

SetBkColor CreateSolidBrush CreateFontIndirectW SetTextColor

comctl32

ImageList_Create ImageList_ReplaceIcon ord17

shell32

DragQueryFileW DragFinish SHFileOperationW ShellExecuteExW SHGetFileInfoW CommandLineToArgvW

comdlg32

GetOpenFileNameW GetSaveFileNameW

shlwapi

PathFileExistsW PathFindFileNameW PathIsDirectoryW

bcrypt

BCryptSetProperty BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptGenRandom BCryptEncrypt

kernel32

HeapReAlloc GetOEMCP GetACP IsValidCodePage ReadConsoleW FindFirstFileExW ReadFile GetConsoleMode GetConsoleOutputCP GetProcessHeap GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetFilePointerEx SetStdHandle HeapSize WriteConsoleW GetLocaleInfoW LCMapStringW LoadLibraryExW VirtualProtect SetEndOfFile FlushFileBuffers HeapAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext HeapFree WriteFile GetStdHandle GetProcAddress GetModuleHandleExW FreeLibrary GetCommandLineW GetEnvironmentVariableW CreateDirectoryW CreateFileW FindClose FindFirstFileW FindNextFileW GetFileSizeEx GetFullPathNameW GetTempPathW CloseHandle GetLastError ReleaseMutex WaitForSingleObject CreateMutexW Sleep WaitForMultipleObjects GetCurrentProcessId GetModuleFileNameW LocalFree BeginUpdateResourceW UpdateResourceW EndUpdateResourceW GetPrivateProfileStringW WritePrivateProfileStringW RtlUnwind EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead TerminateProcess RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetCurrentProcess ExitProcess

Name

.text

Size

200KB

Virtual Size

200KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

SystemFix.exe

user32

gdi32

comctl32

shell32

comdlg32

shlwapi

bcrypt

kernel32

generic