WerFault[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

WerFault.exe
Size

352KB
MD5

48dc3feae7b7fc5bb130c37b433f94cc
SHA1

a1e0cab63a31fc3bd0059a814fe9ad5438225be4
SHA256

c29aa148e585ff4f3877e8c33389b8d87fe921fd64d1189d3aa3c7326dc6f113
SHA512

252ef417a430435f3abe1224598212e4f9a6c6d474f88799f32ff90150644301b9da602018d5728d874a8bbd58393cc459a2bc5656470ac973ab6a4ea3ed6dbe
SSDEEP

6144:7xQkBfdqERY5ua6YPPE+3iuehmDOWE2x6wVJyB60OHyLC7vMA2:7+QdqwVa6hqifh1x2xfc2Hyw0B

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WerFault.exe

Files

WerFault.exe
.exe windows x86

c99cf345b8a92750d027ad73f167506e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
MD5Init
MD5Update
MD5Final
RegSetKeyValueW
EventRegister
EventWrite
EventUnregister
ConvertSidToStringSidW
GetSidSubAuthorityCount
GetSidSubAuthority
EqualSid
RegisterWaitChainCOMCallback
OpenThreadWaitChainSession
GetThreadWaitChain
CloseThreadWaitChainSession
GetFileSecurityW
GetSecurityDescriptorDacl
OpenThreadToken
SetEntriesInAclW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetFileSecurityW
GetTokenInformation
IsValidSid
GetLengthSid
CopySid
DuplicateToken
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
StopTraceW
QueryTraceW
StartTraceW
EnableTrace
RegOpenKeyW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
RegDeleteKeyW
CreateProcessAsUserW
OpenProcessToken

kernel32

CreateProcessW
GetModuleFileNameW
RegEnumKeyExW
DeleteFileW
RegEnumValueW
FileTimeToSystemTime
WriteFile
GetFileAttributesExW
FindClose
FindNextFileW
FindFirstFileW
CreateFileW
RegGetValueW
RegQueryValueExW
GetSystemDefaultLangID
GetProductInfo
GetSystemInfo
LocalFree
MoveFileExW
SetFileAttributesW
GetDiskFreeSpaceExW
ReadFile
GetLocalTime
CreateDirectoryW
SetPriorityClass
OpenProcess
DeviceIoControl
GetFileAttributesW
ReadProcessMemory
LoadLibraryW
SystemTimeToFileTime
GetSystemTime
FreeLibraryAndExitThread
GetExitCodeThread
CreateThread
GetModuleHandleExW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
HeapFree
HeapAlloc
GetProcessHeap
OpenFileMappingW
DuplicateHandle
LoadLibraryExW
QueryFullProcessImageNameW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetThreadUILanguage
GetNativeSystemInfo
SearchPathW
IsWow64Process
GetSystemDirectoryW
GetUserDefaultUILanguage
GetProcessTimes
GetApplicationRestartSettings
MultiByteToWideChar
lstrlenW
FormatMessageW
GetWindowsDirectoryW
GetSystemWow64DirectoryW
GetFileSize
ExpandEnvironmentStringsW
WaitForMultipleObjects
GetFinalPathNameByHandleW
SetFileInformationByHandle
GetLongPathNameW
GetTempPathW
GetTempFileNameW
GetFileSizeEx
CheckRemoteDebuggerPresent
CompareStringW
RegQueryInfoKeyW
SetEvent
GetPriorityClass
GetModuleHandleW
SetEnvironmentVariableW
CreateEventW
GetStringTypeExW
ResetEvent
K32GetModuleFileNameExW
Thread32Next
OpenThread
Thread32First
InitializeCriticalSection
SetThreadpoolWait
EnterCriticalSection
LeaveCriticalSection
GetThreadContext
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
GetProcessId
DeleteCriticalSection
CreateThreadpoolWait
GetProcessIoCounters
GetThreadTimes
GetThreadId
GetProcessIdOfThread
LCMapStringW
OutputDebugStringA
VirtualFree
VirtualAlloc
InterlockedIncrement
InterlockedDecrement
OpenEventW
K32EnumProcessModules
GlobalMemoryStatus
Module32NextW
Module32FirstW
QueryDosDeviceW
GetLogicalDriveStringsW
GetDriveTypeW
FindNextFileNameW
FindFirstFileNameW
CompareFileTime
FindFirstFileExW
GetCurrentThread
GetThreadPriority
SetThreadPriority
WTSGetActiveConsoleSessionId
GetVersionExW
SetLastError
RegDeleteValueW
RegCloseKey
OpenMutexW
GetCommandLineW
CloseHandle
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
Sleep
InterlockedExchange
SetErrorMode
HeapSetInformation
WaitForSingleObject
GetProcAddress
InitializeCriticalSectionAndSpinCount
ReleaseMutex
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
VirtualQuery
CreateMutexW
GetLastError
FreeLibrary
InterlockedCompareExchange
LoadLibraryExA
DelayLoadFailureHook

user32

GetProcessWindowStation
LoadStringW
DispatchMessageW
TranslateMessage
IsHungAppWindow
GetClassNameW
GetWindow
IsWindowEnabled
GetWindowThreadProcessId
SendMessageW
SetWindowPos
GetWindowLongW
GetThreadDesktop
EnumWindows
MonitorFromPoint
GetSystemMetrics
LogicalToPhysicalPoint
GetMonitorInfoW
MonitorFromWindow
IsIconic
GetWindowRect
SetWindowLongW
EndDialog
PostMessageW
LoadIconW
DefWindowProcW
RegisterErrorReportingDialog
CheckWindowThreadDesktop
IsWindow
GetUserObjectInformationW
GetMessageW
RegisterWindowMessageW
ShowWindow
CreateWindowExW
RegisterClassExW
ChangeWindowMessageFilter

msvcrt

iswspace
wcspbrk
_CxxThrowException
memcpy
wcsstr
_wcstoui64
_purecall
_vsnprintf
wcsncmp
_vscwprintf
tolower
towlower
??1type_info@@UAE@XZ
memmove
_wcsnicmp
_wtoi64
_exit
_XcptFilter
exit
_initterm
isspace
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_except_handler4_common
_controlfp
__wgetmainargs
_vsnwprintf
__CxxFrameHandler3
wcschr
_wcsicmp
memset
??3@YAXPAX@Z
??2@YAPAXI@Z
wcsrchr
_wtoi
_unlock
__dllonexit
_lock
_onexit
_cexit

ntdll

RtlCreateProcessReflection
WinSqmAddToStream
WinSqmSetString
RtlFreeHeap
RtlAllocateHeap
NtSetSystemInformation
RtlAdjustPrivilege
NtQueryObject
NtSystemDebugControl
WinSqmIncrementDWORD
NtSuspendProcess
NtResumeProcess
NtQuerySystemInformation
RtlUpcaseUnicodeChar
RtlCompareMemory
ShipAssert
WinSqmEndSession
WinSqmStartSession
WinSqmSetDWORD
NtQueryInformationThread
NtQueryEvent
RtlImageNtHeaderEx
RtlAllocateAndInitializeSid
RtlInitUnicodeString
NtAlpcConnectPort
NtAlpcSendWaitReceivePort
RtlFreeSid
NtOpenEvent
NtWaitForSingleObject
NtClose
EtwEventWriteNoRegistration
RtlNtStatusToDosError
NtQueryInformationProcess
NtQueryInformationToken
EtwTraceMessage
DbgPrint

ole32

CoGetCallState
CoUninitialize
CoCreateInstance
CoInitialize
CoGetActivationState
CoGetObject
StringFromGUID2
CoSetProxyBlanket
CoTaskMemFree
ProgIDFromCLSID
CLSIDFromString
CoCreateGuid

oleaut32

SysAllocStringLen
SysFreeString

shlwapi

ord437

imm32

ImmDisableIME

wer

WerpAddAppCompatData
WerpReportCancel
WerReportCreate
WerpSetIntegratorReportId
WerpGetReportConsent
WerpSetCallBack
WerpAddRegisteredDataToReport
WerReportSetUIOption
WerReportSubmit
WerReportCloseHandle
WerpAddFile
WerpPromtUser
WerpAddSecondaryParameter
WerReportAddDump
WerpSetEventName
WerpSetDynamicParameter
WerReportSetParameter
WerpIsTransportAvailable
WerpGetReportFlags
WerpSetReportFlags
WerpGetNumFiles
WerpGetFileByIndex
WerpCreateIntegratorReportId
WerReportAddFile
WerpFreeString

comctl32

ord410
ord412
ord345
ord413

faultrep

WerpInitiateCrashReporting

Sections

.text
Size: 243KB - Virtual size: 242KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c99cf345b8a92750d027ad73f167506e

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

ntdll

ole32

oleaut32

shlwapi

imm32

wer

comctl32

faultrep

Sections

.text Size: 243KB - Virtual size: 242KB

.data Size: 2KB - Virtual size: 3KB

.rsrc Size: 85KB - Virtual size: 85KB

.reloc Size: 20KB - Virtual size: 20KB

.text
Size: 243KB - Virtual size: 242KB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 85KB - Virtual size: 85KB

.reloc
Size: 20KB - Virtual size: 20KB