FileScope_0[.]3[.]1_x64-portable[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
FileScope_0.3.1_x64-portable.exe
Size 12.8MB
Sample261102-lt2dnaef94
SHA256 c1183f6a0f4b7547d9ca9063ad367f8a6a6d74b0a80d0c076b3a527f8f09133a
MD5 ad444adeb5b1a0921b6348bd3e498d20
SHA1 cad7f13ac6b75434065678cda9f3c3fd3928abde
SHA512 0b00c105470ab776a57fa0da73e5eed30b17c6abc8f56ac5702ecdd29de729590fd167778535f4d198184fcbb91634187345d6c50bc7eac788239435616bc763
SSDEEP 196608:fRb49MVu611XJr6AuSNNkLUNyMOOTEHM2:Zb49MVu611XJr6Au/LnOTEHM
TLSH
T10ED6E6257A5B996CD09BC47483478AA2093534DB0B35B9FF448896382F7EBF46F38319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FileScope_0.3.1_x64-portable.exe

File Explorer

FileScope_0.3.1_x64-portable.exe

.exe 12.8MB

FileScope_0.3.1_x64-portable.exe

IMPHASH 18af113104e9810d7bc5a26232d80fe4
SHA256 c1183f6a0f4b7547d9ca9063ad367f8a6a6d74b0a80d0c076b3a527f8f09133a
MD5 ad444adeb5b1a0921b6348bd3e498d20
SHA1 cad7f13ac6b75434065678cda9f3c3fd3928abde
SHA512 0b00c105470ab776a57fa0da73e5eed30b17c6abc8f56ac5702ecdd29de729590fd167778535f4d198184fcbb91634187345d6c50bc7eac788239435616bc763
SSDEEP 196608:fRb49MVu611XJr6AuSNNkLUNyMOOTEHM2:Zb49MVu611XJr6Au/LnOTEHM
TLSH
T10ED6E6257A5B996CD09BC47483478AA2093534DB0B35B9FF448896382F7EBF46F38319
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9299696

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

filescope.pdb

bcryptprimitives

ProcessPrng

advapi32

SystemFunction036 RegOpenKeyExW RegQueryValueExW RegCloseKey EventUnregister EventRegister EventSetInformation EventWriteTransfer RegGetValueW

ntdll

RtlGetVersion NtCancelIoFileEx NtCreateFile NtReadFile NtDeviceIoControlFile NtOpenFile NtWriteFile RtlNtStatusToDosError NtCreateNamedPipeFile

kernel32

FlsAlloc SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive FlsGetValue FlsSetValue FlsFree FindNextFileW GetTempPathW SetWaitableTimer CreateWaitableTimerExW GetCurrentThreadId WriteConsoleW MultiByteToWideChar SetEnvironmentVariableW GetFinalPathNameByHandleW EncodePointer ReleaseMutex CreateMutexA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread GetSystemInfo ExitProcess GetSystemTimeAsFileTime RtlPcToFileHeader FindClose FindFirstFileExW GetCommandLineW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler SetFilePointerEx CreateDirectoryW GetStdHandle LoadLibraryA RaiseException CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetFileInformationByHandleEx lstrlenW GetModuleHandleW GetSystemTimePreciseAsFileTime RtlLookupFunctionEntry RtlCaptureContext DuplicateHandle GetCurrentProcess ReadFileEx GetCurrentProcessId CreateThread QueryPerformanceCounter QueryPerformanceFrequency HeapReAlloc OutputDebugStringA OutputDebugStringW GetModuleFileNameW GetLastError GetProcessHeap HeapFree LoadLibraryExW InitializeSListHead SetUnhandledExceptionFilter RtlUnwindEx FreeLibrary SetFileTime SetFileInformationByHandle GetUserDefaultUILanguage GetFullPathNameW SetLastError SleepEx WriteFileEx WaitForSingleObject FreeEnvironmentStringsW CompareStringOrdinal RtlVirtualUnwind GetEnvironmentVariableW GetModuleHandleA Sleep GetProcAddress CloseHandle InitializeCriticalSectionEx GetQueuedCompletionStatusEx CancelIoEx PostQueuedCompletionStatus WriteFile LCIDToLocaleName GetOverlappedResult ReadFile LoadLibraryW SetFileCompletionNotificationModes CreateIoCompletionPort LoadLibraryExA SetHandleInformation HeapAlloc SetNamedPipeHandleState DeleteCriticalSection FormatMessageW GetEnvironmentStringsW GetConsoleOutputCP GetFileAttributesW CreateFileW GetFileInformationByHandle GetConsoleMode

user32

RedrawWindow DefWindowProcW ChangeDisplaySettingsExW PeekMessageW SetWindowPlacement VkKeyScanW DestroyMenu PostQuitMessage SetMenu GetWindowPlacement RemoveMenu AppendMenuW InsertMenuW CheckMenuItem SetMenuItemInfoW CreateAcceleratorTableW DestroyAcceleratorTable DrawMenuBar CreatePopupMenu CreateMenu SetWindowPos DrawTextW GetWindowDC OffsetRect GetMenuBarInfo DrawIconEx GetMenuItemInfoW SetTimer KillTimer TrackPopupMenu ChangeWindowMessageFilterEx RegisterClassW DestroyWindow GetAsyncKeyState GetKeyboardState CreateIcon SendInput SetForegroundWindow GetMenu IsWindowVisible PostThreadMessageW LoadCursorW EnumDisplayMonitors MonitorFromPoint SetWindowTextW GetWindowTextW GetWindowTextLengthW SetWindowDisplayAffinity SetCursor GetKeyboardLayout ToUnicodeEx GetKeyState GetRawInputData SystemParametersInfoA SetPropW ClipCursor GetClipCursor TranslateAcceleratorW ShowCursor SetWindowLongW EnableMenuItem GetSystemMenu MapVirtualKeyExW ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx FlashWindowEx RegisterRawInputDevices RegisterClassExW CreateWindowExW PostMessageW DispatchMessageW GetMessageA RegisterWindowMessageA GetWindow SetParent MapWindowPoints DispatchMessageA EnumChildWindows SetFocus ShowWindow InvalidateRgn ReleaseDC GetDC IsProcessDPIAware EnableWindow IsWindowEnabled GetWindowRect SetWindowLongPtrW GetParent GetWindowLongPtrW FindWindowExW SetWindowRgn TranslateMessage GetMessageW MapVirtualKeyW AdjustWindowRect DestroyIcon GetForegroundWindow GetActiveWindow UpdateWindow InvalidateRect SetCursorPos SendMessageW CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SystemParametersInfoW FillRect GetMonitorInfoW MonitorFromRect MonitorFromWindow GetCursorPos ClientToScreen GetClientRect GetWindowLongW ScreenToClient GetUpdateRect ValidateRect IsIconic RegisterTouchWindow GetSystemMetrics IsWindow AdjustWindowRectEx

comctl32

TaskDialogIndirect DefSubclassProc SetWindowSubclass RemoveWindowSubclass

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

ole32

CoCreateInstance CoTaskMemFree CoUninitialize RegisterDragDrop RevokeDragDrop CoInitializeEx CoTaskMemAlloc OleInitialize CoCreateFreeThreadedMarshaler

shlwapi

SHCreateMemStream

gdi32

SetTextColor SetBkMode CreateSolidBrush SelectObject CreateDIBSection DeleteDC CreateCompatibleDC CreateRectRgn GetDeviceCaps DeleteObject BitBlt CombineRgn

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmSetWindowAttribute

shell32

DragFinish DragQueryFileW ShellExecuteW SHAppBarMessage SHGetKnownFolderPath Shell_NotifyIconGetRect SHCreateItemFromParsingName Shell_NotifyIconW

oleaut32

SysFreeString SysStringLen SetErrorInfo GetErrorInfo

ws2_32

getsockopt ioctlsocket connect WSASend WSACleanup WSAStartup recv freeaddrinfo send WSASocketW getaddrinfo bind closesocket WSAGetLastError shutdown setsockopt getsockname getpeername WSAIoctl

bcrypt

BCryptGenRandom

api-ms-win-crt-math-l1-1-0

trunc roundf floor round pow log2 __setusermatherr

api-ms-win-crt-string-l1-1-0

wcscmp _wcsicmp wcslen strcpy_s

api-ms-win-crt-convert-l1-1-0

_wtoi wcstol _ultow_s

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _set_app_type _register_thread_local_exe_atexit_callback _get_initial_narrow_environment _cexit __p___argv _initialize_onexit_table __p___argc _register_onexit_function abort _exit exit _initterm_e _c_exit _configure_narrow_argv _initialize_narrow_environment terminate _crt_atexit _initterm

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh malloc free calloc