fayrw[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fayrw.exe
Size

614KB
MD5

243395a7a5db86caaf0f8782283cd991
SHA1

0ebeb4d66a369102b4a6304e3725e89f4859573d
SHA256

1a6af199b5d7d0fafec3c5d1fea995f3591884f8a0b4cd02e64277c388c347a6
SHA512

75f4d3f307da05911fb08fa224a916ebbbd604a9aee72997a558fff898f81158e8c60cc1c6294236e7a6010d33427bda837d4f77bc1a9c5c4669b14f74da9c22
SSDEEP

12288:8tDszc8BtJL99Z2GUZdmxc5I3X8sW8USUzSp1ed4865/UZm8vbhOqfqvCySndS:82gG2mxjcHfSUzSPNBUZtzhmvCySndS

Score

1^/10

Malware Config

Signatures

Files

fayrw.exe
.exe windows x86

569897bd913b28578d131bc36b001e5d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr80

__CxxQueryExceptionSize
__CxxUnregisterExceptionObject
_cexit
_amsg_exit
__set_app_type
_XcptFilter
__wgetmainargs
_configthreadlocale
__p__commode
__p__fmode
__FrameUnwindFilter
_time64
??2@YAPAXI@Z
??3@YAXPAX@Z
sprintf
memmove
strncmp
strchr
atol
atoi
_strtoui64
??_U@YAPAXI@Z
strncpy
strrchr
strtoul
isdigit
isalpha
_strupr
_gmtime32_s
srand
rand
_wcsupr
wcsncmp
wcstombs
strstr
_aligned_malloc
free
memset
_CxxThrowException
_strnicmp
__CxxDetectRethrow
__CxxRegisterExceptionObject
__CxxExceptionFilter
malloc
__CxxFrameHandler3
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
memcpy
_except_handler3
_crt_debugger_hook
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
_encode_pointer

kernel32

IsDebuggerPresent
SetUnhandledExceptionFilter
Sleep
GetModuleHandleA
UnmapViewOfFile
CloseHandle
InterlockedExchange
VirtualProtect
VirtualQuery
GetCurrentThreadId
InterlockedIncrement
InterlockedCompareExchange
InterlockedDecrement
GetCurrentProcessId
CreateMutexA
WaitForSingleObject
ReleaseMutex
FindResourceA
LoadResource
UnhandledExceptionFilter
CreateToolhelp32Snapshot
Module32First
GetProcAddress
Module32Next
EnumResourceNamesA
GetModuleFileNameA
CreateFileA
ReadFile
VirtualAlloc
SetFilePointer
VirtualFree
GetModuleHandleExA
CreateEventA
ExitProcess
SetEvent
GetExitCodeThread
TerminateThread
CreateThread
HeapAlloc
HeapFree
GetComputerNameW
WideCharToMultiByte
LocalFree
HeapCreate
HeapDestroy
GetSystemTime
SystemTimeToFileTime
GetCommandLineW
GlobalAlloc
GetSystemInfo
GetWindowsDirectoryA
GetVolumeInformationA
DeviceIoControl
GetCurrentThread
CreateFileW
GlobalFree
LoadLibraryA
TlsAlloc
TlsSetValue
TlsGetValue
TlsFree
FreeLibrary
MapViewOfFile
CreateFileMappingA
lstrcmpA
LocalAlloc
GetModuleFileNameW
GetLastError
InitializeSListHead
InterlockedPushEntrySList
InterlockedPopEntrySList
GetProcessHeap
OutputDebugStringA
GetCurrentProcess
TerminateProcess
LockResource
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
lstrlenW
MultiByteToWideChar
lstrlenA

advapi32

CryptAcquireContextA
CryptDestroyKey
CryptExportKey
CryptGenKey
CloseEventLog
ReadEventLogA
GetNumberOfEventLogRecords
OpenEventLogA
CryptGenRandom
LookupAccountSidW
ConvertSidToStringSidA
GetTokenInformation
SetThreadToken
RevertToSelf
RegOpenKeyExA
RegEnumValueA
RegCloseKey
OpenThreadToken
CryptCreateHash
CryptReleaseContext
CryptHashData
CryptDestroyHash
CryptGetHashParam
OpenProcessToken

oleaut32

CreateErrorInfo
GetErrorInfo
VariantChangeType
SetErrorInfo
VariantClear
VariantInit
SysFreeString
SystemTimeToVariantTime
SysAllocString

msvcm80

?DoDllLanguageSupportValidation@<CrtImplementationDetails>@@YAXXZ
?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@P$AAVException@3@@Z
__setusermatherr_m
?RegisterModuleUninitializer@<CrtImplementationDetails>@@YAXP$AAVEventHandler@System@@@Z
?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@@Z
?ThrowNestedModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVException@System@@0@Z
?DoCallBackInDefaultDomain@<CrtImplementationDetails>@@YAXP6GJPAX@Z0@Z

mscoree

GetHashFromFileW
_CorExeMain

ws2_32

setsockopt
WSACleanup
freeaddrinfo
getaddrinfo
closesocket
WSAStartup
socket
send
recv
shutdown
connect

wintrust

CryptCATCatalogInfoFromContext
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminAcquireContext
CryptCATAdminReleaseCatalogContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminReleaseContext
WinVerifyTrust

crypt32

CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringA
CryptMsgClose
CertCloseStore
CryptDecodeObject
CryptMsgGetParam
CryptQueryObject

iphlpapi

GetAdaptersAddresses
GetAdaptersInfo

ole32

CoInitializeEx
CoCreateInstance
CoUninitialize
CoSetProxyBlanket
CoTaskMemAlloc

shell32

CommandLineToArgvW

setupapi

SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyA
SetupDiClassNameFromGuidA
SetupDiEnumDeviceInfo
SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA

rpcrt4

UuidCreate

Sections

.text
Size: 458KB - Virtual size: 457KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 122KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

569897bd913b28578d131bc36b001e5d

Headers

File Characteristics

Imports

msvcr80

kernel32

advapi32

oleaut32

msvcm80

mscoree

ws2_32

wintrust

crypt32

iphlpapi

ole32

shell32

setupapi

rpcrt4

Sections

.text Size: 458KB - Virtual size: 457KB

.rdata Size: 122KB - Virtual size: 122KB

.data Size: 6KB - Virtual size: 10KB

.rsrc Size: 6KB - Virtual size: 6KB

.reloc Size: 13KB - Virtual size: 12KB

.text
Size: 458KB - Virtual size: 457KB

.rdata
Size: 122KB - Virtual size: 122KB

.data
Size: 6KB - Virtual size: 10KB

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 13KB - Virtual size: 12KB