fnafr[.]exe[.]7z | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fnafr.exe.7z
Size

57.6MB
MD5

fc63a673a438051e50909fafc7069a35
SHA1

be662e2664baaedfe1d3c60d448b2fa5d49007c1
SHA256

bbbc114874c294e9e87808bc460c0696a2660a08141950bb0f95afa607398856
SHA512

8b2b71ad0aa5ea847d210031c089127669478094c96756e049b21bd2b3a46e55ade6c6ec3f9671663215c9bc7e1382007e3b92c9861459d12feef30cdcac90f7
SSDEEP

1572864:FvmBBjQSbsS1nh2Fbgx+t9nDoZS6gLnluCZ:VmBqSbVhhL6nDoZLgLluC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/fnafr.exe

Files

fnafr.exe.7z
.7z

Password: infected
fnafr.exe
.exe windows:4 windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 291KB - Virtual size: 290KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ