Behavioral task
behavioral1
Sample
2428-1016-0x0000000003640000-0x0000000003771000-memory.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2428-1016-0x0000000003640000-0x0000000003771000-memory.dll
Resource
win10v2004-20230915-en
General
-
Target
2428-1016-0x0000000003640000-0x0000000003771000-memory.dmp
-
Size
1.2MB
-
MD5
ae7ba776eb076057c9bfca17ce575217
-
SHA1
3716bf1a926a98e275064f96c73b28f818bf33a2
-
SHA256
3917a2657e0bc9c25562b6d4e9599247ae31d3c529b5260058d18f0e4cdc0fe2
-
SHA512
e54527af9790d692516f3c18da1b0b4e691a5ad4add66118ad44c8c26e5c9c4edb0f63374a6781a172151f2bca9e8c9dde0ba10024f3d7dcc4eb0b8e37fe8d62
-
SSDEEP
24576:3C7CI9TZDEWk1wCy0zaG9cQAT1ftxmbfYQJZKYfu:7I99DEWVtQATZmn0K
Malware Config
Extracted
fabookie
http://app.nnnaajjjgc.com/check/safe
Signatures
-
Detect Fabookie payload 1 IoCs
resource yara_rule sample family_fabookie -
Fabookie family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2428-1016-0x0000000003640000-0x0000000003771000-memory.dmp
Files
-
2428-1016-0x0000000003640000-0x0000000003771000-memory.dmp.dll windows:6 windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Sections
.text Size: 906KB - Virtual size: 905KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 215KB - Virtual size: 214KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 25KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ