Static task
static1
Behavioral task
behavioral1
Sample
fodhelper.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
fodhelper.exe
Resource
win10v2004-20230703-en
General
-
Target
fodhelper.exe
-
Size
46KB
-
MD5
f23bcf023d5039ccab3aa40f6a07b817
-
SHA1
4d0de1c3121f202604a01c6dc6f6a36f4a0a4619
-
SHA256
b1223b86d03c3583b84e46a9a6ad009d770fc4114640402ede19793167593a8f
-
SHA512
93249ccbf00b0cc62c9eb05535563c443a37830ce5eab6ec068ca50ef544e9643f8c5e3e6ec484f6a1767f3d21894cd99d9329ec4bbf02fee7bb895cc75ba394
-
SSDEEP
768:YqpZqknV+b+pvxg9JWSALQJnjpt6V3Glw1mHXrzg31TdavZZ7RRr:pqQApW3WOV3Gy1mHX61TSZZTr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fodhelper.exe
Files
-
fodhelper.exe.exe windows x64
6d73af98ce8e7ae977b7d4d284ba1156
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
RegCloseKey
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyW
RegOpenKeyExW
RegDeleteKeyW
RegCreateKeyExW
kernel32
HeapFree
GetModuleHandleExW
HeapAlloc
GetProcAddress
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
SetEvent
InitializeCriticalSectionAndSpinCount
GetLastError
InitializeCriticalSectionEx
DeleteCriticalSection
HeapSetInformation
GetCommandLineW
CloseHandle
CreateThread
ResumeThread
RaiseException
EncodePointer
CreateEventW
GetSystemDirectoryW
DecodePointer
WaitForMultipleObjects
WaitForSingleObject
GetFileAttributesW
GetModuleFileNameW
VirtualQuery
msvcrt
__setusermatherr
__dllonexit
_acmdln
_fmode
_cexit
__set_app_type
_commode
_lock
exit
_ismbblead
towupper
__C_specific_handler
_XcptFilter
_unlock
memset
_amsg_exit
_exit
_initterm
?terminate@@YAXXZ
_onexit
__getmainargs
memmove
memcpy
wcschr
_vsnwprintf
_wcsicmp
memcmp
wcscmp
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoTaskMemFree
CoResumeClassObjects
CoRegisterClassObject
CoRevokeClassObject
CoCreateInstance
CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoSuspendClassObjects
CoReleaseServerProcess
CoAddRefServerProcess
api-ms-win-core-winrt-l1-1-0
RoInitialize
RoUninitialize
RoGetActivationFactory
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
WindowsGetStringRawBuffer
rpcrt4
UuidToStringW
RpcStringFreeW
oleaut32
LoadTypeLi
RegisterTypeLi
UnRegisterTypeLi
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetStartupInfoW
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
FindResourceExW
LoadResource
LockResource
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
ntdll
RtlPublishWnfStateData
shell32
ShellExecuteExW
CommandLineToArgvW
Sections
.text Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.imrsiv Size: - Virtual size: 4B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 144B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ