Behavioral task
behavioral1
Sample
640-347-0x0000000003690000-0x00000000037C1000-memory.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
640-347-0x0000000003690000-0x00000000037C1000-memory.dll
Resource
win10v2004-20230915-en
General
-
Target
640-347-0x0000000003690000-0x00000000037C1000-memory.dmp
-
Size
1.2MB
-
MD5
8840679180b29a0b6e0e748d77e4bb2b
-
SHA1
3eb70ce6c2243d16fbb62b0a3f2d034a5b04dd68
-
SHA256
a2c964d4ab1ec07c6555ef19f344e8b7354ebeae658b0fae1d2bd9ca23b4eabd
-
SHA512
f3aa6fcbf97063f41b0156c21a0645d0498033b3dc0f5d696f45e369799e3e05163dc71f00e78ce5ab56414211cc014bbfd66ae0a54e268ab2982307754f833e
-
SSDEEP
24576:3C7CI9TZDEWk1wCy0zaG9cQA81ftxmbfYQJZKWcY:7I99DEWVtQA8Zmn0r
Malware Config
Extracted
fabookie
http://app.nnnaajjjgc.com/check/safe
Signatures
-
Detect Fabookie payload 1 IoCs
resource yara_rule sample family_fabookie -
Fabookie family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 640-347-0x0000000003690000-0x00000000037C1000-memory.dmp
Files
-
640-347-0x0000000003690000-0x00000000037C1000-memory.dmp.dll windows:6 windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Sections
.text Size: 906KB - Virtual size: 905KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 215KB - Virtual size: 214KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 25KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ