Fedoraware[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

Fedoraware.zip
Size

7.6MB
MD5

1c10a8f2a2ffa1b9f90840b42d3ac712
SHA1

326ceb021a06ee4f0653a202d6ed4352a8cfa0b8
SHA256

8e53cbed10f2d617f68bb1e4bf1651543450222f0950cc2c5725f89b88df0314
SHA512

6154a608ad759189066fa445edd71aadede06f5c784f7c5dc3c047e8df96f324b2621d4dd5ba7539d4dcc9422a370b875bcd878352b2e4f58239f6d126907b64
SSDEEP

196608:KVX0gV1Coxy6d9U1Pw6NZKxKmwx1iJtz2RRr/qVvhfw/KZyh9LH9G:SE0gJ/uxKTUWRr/qM/VXU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Fware(Release).dll

Files

Fedoraware.zip
.zip
Fware(Release).dll
.dll windows x86

e660f8448345400038bb053645fdcc82

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

QueryPerformanceFrequency
GetProcAddress
FreeLibrary
QueryPerformanceCounter
GetPrivateProfileSectionNamesA
WritePrivateProfileStringA
GetPrivateProfileStringA
ReadFile
WriteFile
PeekNamedPipe
CreateFileW
GetLastError
GetCurrentProcessId
WaitNamedPipeW
VirtualFree
VirtualAlloc
VirtualQuery
HeapCreate
HeapFree
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
HeapReAlloc
HeapAlloc
HeapDestroy
GetThreadContext
FlushInstructionCache
SetThreadContext
OpenThread
LoadLibraryW
ExitProcess
GetCurrentDirectoryW
GetModuleHandleA
GetSystemTimeAsFileTime
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
InitializeSListHead
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
InitOnceBeginInitialize
InitOnceComplete
GetLocaleInfoEx
FormatMessageA
LocalFree
GetFileInformationByHandleEx
AreFileApisANSI
SetFileInformationByHandle
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
SetUnhandledExceptionFilter
GetModuleHandleW
CreateThread
CloseHandle
GetFileAttributesExW
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
LoadLibraryA
FreeLibraryAndExitThread
TerminateProcess
VirtualProtect

user32

OpenClipboard
GetClientRect
CloseClipboard
GetCursorPos
GetClipboardData
SetClipboardData
MessageBoxA
GetAsyncKeyState
SetCursor
ReleaseCapture
EmptyClipboard
SetCapture
wsprintfW
CallWindowProcW
FindWindowW
MessageBoxW
SetWindowLongW
MapVirtualKeyW
GetKeyNameTextW
FindWindowA
GetKeyState
SetCursorPos
ScreenToClient
GetCapture
ClientToScreen
IsChild
TrackMouseEvent
GetForegroundWindow
LoadCursorW

shell32

ShellExecuteA
SHGetFolderPathW

msvcp140

?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?copyfmt@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEAAV12@ABV12@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
_Query_perf_frequency
_Query_perf_counter
?_Xbad_alloc@std@@YAXXZ
?_Xbad_function_call@std@@YAXXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Winerror_map@std@@YAHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Syserror_map@std@@YAPBDH@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
?_Xinvalid_argument@std@@YAXPBD@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Throw_C_error@std@@YAXH@Z
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_init_in_situ
_Mtx_unlock
_Thrd_sleep
_Xtime_get_ticks
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?id@?$ctype@D@std@@2V0locale@2@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAM@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
_Strxfrm
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$collate@D@std@@2V0locale@2@A
_Strcoll
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
?tolower@?$ctype@D@std@@QBEDD@Z
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?swap@?$basic_ostream@DU?$char_traits@D@std@@@std@@IAEXAAV12@@Z
?swap@?$basic_istream@DU?$char_traits@D@std@@@std@@IAEXAAV12@@Z
_Mtx_current_owns
_Cnd_init_in_situ
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_timedwait
_Cnd_do_broadcast_at_thread_exit
_Thrd_id
_Thrd_join
_Cnd_broadcast
_Cnd_destroy_in_situ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
?_Xlength_error@std@@YAXPBD@Z
?_Random_device@std@@YAIXZ
?_Xout_of_range@std@@YAXPBD@Z
?uncaught_exception@std@@YA_NXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z

imm32

ImmSetCompositionWindow
ImmGetContext
ImmReleaseContext

vcruntime140

__std_exception_copy
memmove
memcpy
memchr
__std_exception_destroy
_except_handler4_common
_CxxThrowException
memset
__current_exception_context
__current_exception
__std_type_info_destroy_list
__std_type_info_compare
__CxxFrameHandler3
strchr
strstr
__std_type_info_name
_purecall
__std_terminate

api-ms-win-crt-math-l1-1-0

_hypotf
_libm_sse2_log_precise
_libm_sse2_pow_precise
_fdclass
_CIfmod
_libm_sse2_sin_precise
_libm_sse2_sqrt_precise
_libm_sse2_atan_precise
ceil
_CIatan2
_libm_sse2_acos_precise
floor
remainderf
fminf
roundf
fmaxf
remainder
_libm_sse2_tan_precise
fmin
fmax
_libm_sse2_cos_precise

api-ms-win-crt-runtime-l1-1-0

_wassert
_invalid_parameter_noinfo_noreturn
abort
_beginthreadex
terminate
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_register_onexit_function
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_initialize_onexit_table
_errno

api-ms-win-crt-heap-l1-1-0

malloc
free
realloc
_callnewh

api-ms-win-crt-stdio-l1-1-0

fgetc
fwrite
__stdio_common_vswprintf_s
_fseeki64
fclose
fflush
fread
__stdio_common_vsnprintf_s
fgetpos
setvbuf
_get_stream_buffer_pointers
fputc
__stdio_common_vsprintf_s
ftell
__stdio_common_vsscanf
__stdio_common_vsprintf
_wfopen
ungetc
fseek
fsetpos

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_unlock_file

api-ms-win-crt-convert-l1-1-0

atof
mbstowcs
strtol
strtof

api-ms-win-crt-string-l1-1-0

isblank
isspace
strncmp
isalnum
toupper
strncpy

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64
clock
_time64

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 474KB - Virtual size: 473KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 160KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Fware(Release).pdb

Sharing

General

Malware Config

Signatures

Files

e660f8448345400038bb053645fdcc82

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

msvcp140

imm32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 474KB - Virtual size: 473KB

.data Size: 160KB - Virtual size: 1.1MB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 97KB - Virtual size: 97KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 474KB - Virtual size: 473KB

.data
Size: 160KB - Virtual size: 1.1MB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 97KB - Virtual size: 97KB