fsavailux[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

fsavailux.exe
Size

17KB
MD5

9bf3b32a357fc15eb03df5f58752c393
SHA1

a5355ef7ddc3912c5630f56daba667e3b81519d6
SHA256

b6f49fbe12f91bec54cf7ec214f808db0dca04f99b71fae2f47a75ebae16521e
SHA512

a12b0dee1aa58458ce0ea5067ac8aa580498a8f1957dcc79865ffe5e73dda62fc6b157f10b1a19fec5fa801ffa8dc4e68099900b2d7b3189b96cf5668e2e8121
SSDEEP

384:YvcJm6/P7HHt8Bp6PVCK1ub9Sj1RWgmWW:hJ3/P7ntgp6tOm1G

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fsavailux.exe

Files

fsavailux.exe
.exe windows x64

7906a2680f0c0553216922f1e3808813

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken

kernel32

LoadLibraryW
GetProcAddress
FreeLibrary
GetCurrentProcess
Sleep
GetStartupInfoW
SetUnhandledExceptionFilter
GetModuleHandleW
CloseHandle
CreateFileW
GetLastError
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
TerminateProcess
DeviceIoControl

user32

ExitWindowsEx

msvcrt

__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
_wcmdln
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
free
memset
realloc
?terminate@@YAXXZ
_commode
exit
_fmode

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

ifsutil

?PushEntry@AUTOREG@@SAEPEBVWSTRING@@@Z
?IsEntryPresent@AUTOREG@@SAEPEBVWSTRING@@@Z

ulib

??1ARGUMENT_LEXEMIZER@@UEAA@XZ
??0ARGUMENT_LEXEMIZER@@QEAA@XZ
?Initialize@STRING_ARGUMENT@@QEAAEPEAD@Z
??1STRING_ARGUMENT@@UEAA@XZ
??0STRING_ARGUMENT@@QEAA@XZ
?Strcat@WSTRING@@QEAAEPEBG@Z
?Initialize@WSTRING@@QEAAEPEBDK@Z
?DoParsing@ARGUMENT_LEXEMIZER@@QEAAEPEAVARRAY@@@Z
?IsValueSet@ARGUMENT@@QEAAEXZ
??0FLAG_ARGUMENT@@QEAA@XZ
?Initialize@FLAG_ARGUMENT@@QEAAEPEAD@Z
??0ARRAY@@QEAA@XZ
??1ARRAY@@UEAA@XZ
?Initialize@ARRAY@@QEAAEKK@Z
?Put@ARRAY@@UEAAEPEAVOBJECT@@@Z
??1DSTRING@@UEAA@XZ
?Initialize@ARGUMENT_LEXEMIZER@@QEAAEPEAVARRAY@@@Z
?PutSeparators@ARGUMENT_LEXEMIZER@@QEAAXPEBD@Z
?PutSwitches@ARGUMENT_LEXEMIZER@@QEAAXPEBD@Z
?PrepareToParse@ARGUMENT_LEXEMIZER@@QEAAEPEAVWSTRING@@@Z
?SetCaseSensitive@ARGUMENT_LEXEMIZER@@QEAAXE@Z
??1OBJECT@@UEAA@XZ
??0DSTRING@@QEAA@XZ

comctl32

ord345

api-ms-win-core-com-l1-1-0

CoInitializeEx

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7906a2680f0c0553216922f1e3808813

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

ntdll

ifsutil

ulib

comctl32

api-ms-win-core-com-l1-1-0

Sections

.text Size: 6KB - Virtual size: 6KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 512B - Virtual size: 288B

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 32B

.text
Size: 6KB - Virtual size: 6KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 512B - Virtual size: 288B

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 32B