Behavioral task
behavioral1
Sample
9d98a46e53d6984480a9422eec7efcfdabb406281d3b4c5244f4ca3ceccfbc0b.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
9d98a46e53d6984480a9422eec7efcfdabb406281d3b4c5244f4ca3ceccfbc0b.exe
Resource
win10v2004-20231025-en
General
-
Target
9d98a46e53d6984480a9422eec7efcfdabb406281d3b4c5244f4ca3ceccfbc0b
-
Size
1.4MB
-
MD5
818b630dbc0561c45e768ffed4331b5b
-
SHA1
597ff7a6d34c0d514ca865629126b39eb9e496a4
-
SHA256
9d98a46e53d6984480a9422eec7efcfdabb406281d3b4c5244f4ca3ceccfbc0b
-
SHA512
11dbd4f2d0b4e5764d7a2c140d3dea7483caa610a6fe765305e6aed15ccacad150396fae4093d7456688400eeeb3529e1d60fec7b924c5167dd29fe8eb8ef19d
-
SSDEEP
24576:mYCFCdoKbl2cVdrAXIwK3+X5TNkdBAnlXG6+Z1mbXbh/KKlUmpRee:osbl2cVdrKIX+XXkUlXF+Z1Irh/KKlUs
Malware Config
Signatures
-
Detect Fabookie payload 1 IoCs
resource yara_rule sample family_fabookie -
Fabookie family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9d98a46e53d6984480a9422eec7efcfdabb406281d3b4c5244f4ca3ceccfbc0b
Files
-
9d98a46e53d6984480a9422eec7efcfdabb406281d3b4c5244f4ca3ceccfbc0b.exe windows:6 windows x86
af32313fc3f12018e1ca631ff1044218
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SizeofResource
GetTempPathA
LockResource
GetModuleHandleW
FindResourceW
WinExec
WriteConsoleW
CreateThread
CopyFileA
GetModuleFileNameA
LocalFree
GetLastError
FormatMessageW
Sleep
LoadResource
lstrlenW
HeapSize
CreateFileW
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetProcAddress
CloseHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlUnwind
RaiseException
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
WriteFile
HeapReAlloc
HeapFree
HeapAlloc
GetFileType
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
GetConsoleCP
GetConsoleMode
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
DeleteFileW
ReadFile
ReadConsoleW
SetEndOfFile
advapi32
RegSetValueExW
RegOpenKeyExW
RegCreateKeyW
RegCloseKey
AllocateAndInitializeSid
RegSetValueExA
FreeSid
CheckTokenMembership
RegOpenKeyExA
shell32
ShellExecuteExA
winhttp
WinHttpQueryHeaders
WinHttpReadData
WinHttpOpenRequest
WinHttpSetOption
WinHttpCloseHandle
WinHttpAddRequestHeaders
WinHttpQueryAuthSchemes
WinHttpGetProxyForUrl
WinHttpSendRequest
WinHttpSetCredentials
WinHttpConnect
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpOpen
WinHttpGetIEProxyConfigForCurrentUser
Sections
.text Size: 393KB - Virtual size: 392KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 96KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 454KB - Virtual size: 453KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ