Behavioral task
behavioral1
Sample
18d546564353cbf11d9e2c0f74cdd19bf6535eb01c691ec466e0354045f226a0.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
18d546564353cbf11d9e2c0f74cdd19bf6535eb01c691ec466e0354045f226a0.exe
Resource
win10v2004-20231023-en
General
-
Target
18d546564353cbf11d9e2c0f74cdd19bf6535eb01c691ec466e0354045f226a0
-
Size
973KB
-
MD5
b3e7d6c561c510168048cb656a3c7fa6
-
SHA1
715ce0de0a99feebd7f0bc9daa9c728188e19cb7
-
SHA256
18d546564353cbf11d9e2c0f74cdd19bf6535eb01c691ec466e0354045f226a0
-
SHA512
dbe65f0d47a9b64cf765cbca171647553aa56fcdbaa083b4b16599d1a85334ff3f7130392850e2eb524eab3f0260a141414ab03df6e9bc6a4ec55215dfb7bda2
-
SSDEEP
24576:5YCFCdoKbl2cVdrAXIwK3+X5TNkdBAnlXG6+Z1mbX:nsbl2cVdrKIX+XXkUlXF+Z1I
Malware Config
Signatures
-
Detect Fabookie payload 1 IoCs
resource yara_rule sample family_fabookie -
Fabookie family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 18d546564353cbf11d9e2c0f74cdd19bf6535eb01c691ec466e0354045f226a0
Files
-
18d546564353cbf11d9e2c0f74cdd19bf6535eb01c691ec466e0354045f226a0.exe windows:6 windows x86
af32313fc3f12018e1ca631ff1044218
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SizeofResource
GetTempPathA
LockResource
GetModuleHandleW
FindResourceW
WinExec
WriteConsoleW
CreateThread
CopyFileA
GetModuleFileNameA
LocalFree
GetLastError
FormatMessageW
Sleep
LoadResource
lstrlenW
HeapSize
CreateFileW
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetProcAddress
CloseHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlUnwind
RaiseException
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
WriteFile
HeapReAlloc
HeapFree
HeapAlloc
GetFileType
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
GetConsoleCP
GetConsoleMode
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
DeleteFileW
ReadFile
ReadConsoleW
SetEndOfFile
advapi32
RegSetValueExW
RegOpenKeyExW
RegCreateKeyW
RegCloseKey
AllocateAndInitializeSid
RegSetValueExA
FreeSid
CheckTokenMembership
RegOpenKeyExA
shell32
ShellExecuteExA
winhttp
WinHttpQueryHeaders
WinHttpReadData
WinHttpOpenRequest
WinHttpSetOption
WinHttpCloseHandle
WinHttpAddRequestHeaders
WinHttpQueryAuthSchemes
WinHttpGetProxyForUrl
WinHttpSendRequest
WinHttpSetCredentials
WinHttpConnect
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpOpen
WinHttpGetIEProxyConfigForCurrentUser
Sections
.text Size: 393KB - Virtual size: 392KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 96KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 454KB - Virtual size: 453KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ