WerFault[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

WerFault.exe
Size

352KB
MD5

5feab868caedbbd1b7a145ca8261e4aa
SHA1

f43f28cc5165608e6fb3794e9a3d083ca2c75f0e
SHA256

08bace187a0225e10677de9aa6738a7118be3e5cad6dc45fb8d3366a61bb343c
SHA512

91108ab6dd422c1d500fc0a65df6faffdb7000828a0f908b1c053129b4b8702fdb7309fa3f4f6054ad542dfe24fd4853e2fe32f7e45aa369e7a3cb6137bdaca1
SSDEEP

6144:EfGA1VEJ06T4yDJ43GMWFwE8tIw6sVJyB60OHyLC7vO+s71h:EuuVEJl4ySGMAwxIwPc2Hywm++1h

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WerFault.exe

Files

WerFault.exe
.exe windows x86

9e033013a54c838941e1e6b8dc42511d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
MD5Init
MD5Update
MD5Final
RegSetKeyValueW
EventRegister
EventWrite
EventUnregister
ConvertSidToStringSidW
GetSidSubAuthorityCount
GetSidSubAuthority
EqualSid
RegisterWaitChainCOMCallback
OpenThreadWaitChainSession
GetThreadWaitChain
CloseThreadWaitChainSession
GetFileSecurityW
GetSecurityDescriptorDacl
OpenThreadToken
SetEntriesInAclW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetFileSecurityW
GetTokenInformation
IsValidSid
GetLengthSid
CopySid
DuplicateToken
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
StopTraceW
QueryTraceW
StartTraceW
EnableTrace
RegOpenKeyW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
CreateProcessAsUserW
RegDeleteKeyW
OpenProcessToken

kernel32

RegQueryInfoKeyW
CreateProcessW
GetModuleFileNameW
DeleteFileW
RegEnumValueW
FileTimeToSystemTime
WriteFile
GetFileAttributesExW
FindClose
FindNextFileW
FindFirstFileW
CreateFileW
RegGetValueW
RegQueryValueExW
GetSystemDefaultLangID
GetProductInfo
GetSystemInfo
LocalFree
MoveFileExW
SetFileAttributesW
GetDiskFreeSpaceExW
ReadFile
GetLocalTime
CreateDirectoryW
SetPriorityClass
OpenProcess
DeviceIoControl
GetFileAttributesW
ReadProcessMemory
LoadLibraryW
SystemTimeToFileTime
GetSystemTime
FreeLibraryAndExitThread
GetExitCodeThread
CreateThread
GetModuleHandleExW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
HeapFree
HeapAlloc
GetProcessHeap
OpenFileMappingW
DuplicateHandle
LoadLibraryExW
QueryFullProcessImageNameW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetThreadUILanguage
GetNativeSystemInfo
SearchPathW
IsWow64Process
GetSystemDirectoryW
GetUserDefaultUILanguage
GetProcessTimes
GetApplicationRestartSettings
MultiByteToWideChar
lstrlenW
FormatMessageW
GetWindowsDirectoryW
GetSystemWow64DirectoryW
GetFileSize
ExpandEnvironmentStringsW
WaitForMultipleObjects
RemoveDirectoryW
GetLongPathNameW
GetTempPathW
GetTempFileNameW
GetFileSizeEx
CheckRemoteDebuggerPresent
CompareStringW
VirtualQuery
RegEnumKeyExW
GetPriorityClass
GetModuleHandleW
SetEnvironmentVariableW
CreateEventW
GetStringTypeExW
ResetEvent
K32GetModuleFileNameExW
Thread32Next
OpenThread
Thread32First
InitializeCriticalSection
SetThreadpoolWait
EnterCriticalSection
LeaveCriticalSection
GetThreadContext
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
GetProcessId
DeleteCriticalSection
CreateThreadpoolWait
GetProcessIoCounters
GetThreadTimes
GetThreadId
GetProcessIdOfThread
LCMapStringW
OutputDebugStringA
VirtualFree
VirtualAlloc
InterlockedIncrement
InterlockedDecrement
OpenEventW
K32EnumProcessModules
GlobalMemoryStatus
Module32NextW
Module32FirstW
QueryDosDeviceW
GetLogicalDriveStringsW
GetDriveTypeW
FindNextFileNameW
FindFirstFileNameW
CompareFileTime
FindFirstFileExW
GetCurrentThread
GetThreadPriority
SetThreadPriority
WTSGetActiveConsoleSessionId
GetVersionExW
SetLastError
RegDeleteValueW
RegCloseKey
OpenMutexW
GetCommandLineW
CloseHandle
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
Sleep
InterlockedExchange
SetErrorMode
HeapSetInformation
WaitForSingleObject
GetProcAddress
InitializeCriticalSectionAndSpinCount
ReleaseMutex
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
SetEvent
CreateMutexW
GetLastError
FreeLibrary
InterlockedCompareExchange
LoadLibraryExA
DelayLoadFailureHook

user32

GetProcessWindowStation
LoadStringW
DispatchMessageW
TranslateMessage
IsHungAppWindow
GetClassNameW
GetWindow
IsWindowEnabled
GetWindowThreadProcessId
SendMessageW
SetWindowPos
GetWindowLongW
GetThreadDesktop
EnumWindows
MonitorFromPoint
GetSystemMetrics
LogicalToPhysicalPoint
GetMonitorInfoW
MonitorFromWindow
IsIconic
GetWindowRect
SetWindowLongW
EndDialog
PostMessageW
LoadIconW
DefWindowProcW
RegisterErrorReportingDialog
CheckWindowThreadDesktop
IsWindow
GetUserObjectInformationW
GetMessageW
RegisterWindowMessageW
ShowWindow
CreateWindowExW
RegisterClassExW
ChangeWindowMessageFilter

msvcrt

iswspace
wcspbrk
_CxxThrowException
memcpy
wcsstr
_wcstoui64
_purecall
_vsnprintf
wcsncmp
_vscwprintf
tolower
towlower
??1type_info@@UAE@XZ
memmove
_wcsnicmp
_wtoi64
_exit
_XcptFilter
exit
_initterm
isspace
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_except_handler4_common
_controlfp
__wgetmainargs
_vsnwprintf
__CxxFrameHandler3
wcschr
_wcsicmp
memset
??3@YAXPAX@Z
??2@YAPAXI@Z
wcsrchr
_wtoi
_unlock
__dllonexit
_lock
_onexit
_cexit

ntdll

RtlCreateProcessReflection
WinSqmAddToStream
WinSqmSetString
RtlFreeHeap
RtlAllocateHeap
NtSetSystemInformation
RtlAdjustPrivilege
NtQueryObject
NtSystemDebugControl
WinSqmIncrementDWORD
NtSuspendProcess
NtResumeProcess
NtQuerySystemInformation
RtlUpcaseUnicodeChar
RtlCompareMemory
ShipAssert
WinSqmEndSession
WinSqmStartSession
WinSqmSetDWORD
NtQueryInformationThread
NtQueryEvent
RtlImageNtHeaderEx
RtlAllocateAndInitializeSid
RtlInitUnicodeString
NtAlpcConnectPort
NtAlpcSendWaitReceivePort
RtlFreeSid
NtOpenEvent
NtWaitForSingleObject
NtClose
EtwEventWriteNoRegistration
RtlNtStatusToDosError
NtQueryInformationProcess
NtQueryInformationToken
EtwTraceMessage
DbgPrint

ole32

CoGetCallState
CoUninitialize
CoCreateInstance
CoInitialize
CoGetActivationState
CoGetObject
StringFromGUID2
CoSetProxyBlanket
CoTaskMemFree
ProgIDFromCLSID
CLSIDFromString
CoCreateGuid

oleaut32

SysAllocStringLen
SysFreeString

shlwapi

ord437

imm32

ImmDisableIME

wer

WerpAddAppCompatData
WerpReportCancel
WerpSetIntegratorReportId
WerpGetReportConsent
WerpSetCallBack
WerReportSetUIOption
WerpAddRegisteredDataToReport
WerReportCreate
WerReportAddFile
WerReportSubmit
WerpAddFile
WerpPromtUser
WerpAddSecondaryParameter
WerReportAddDump
WerpSetEventName
WerpSetDynamicParameter
WerReportSetParameter
WerpIsTransportAvailable
WerpGetReportFlags
WerpSetReportFlags
WerpGetNumFiles
WerpGetFileByIndex
WerpCreateIntegratorReportId
WerReportCloseHandle
WerpFreeString

comctl32

ord410
ord412
ord345
ord413

faultrep

WerpInitiateCrashReporting

Sections

.text
Size: 242KB - Virtual size: 242KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9e033013a54c838941e1e6b8dc42511d

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

ntdll

ole32

oleaut32

shlwapi

imm32

wer

comctl32

faultrep

Sections

.text Size: 242KB - Virtual size: 242KB

.data Size: 2KB - Virtual size: 3KB

.rsrc Size: 85KB - Virtual size: 85KB

.reloc Size: 20KB - Virtual size: 20KB

.text
Size: 242KB - Virtual size: 242KB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 85KB - Virtual size: 85KB

.reloc
Size: 20KB - Virtual size: 20KB