Static task
static1
Behavioral task
behavioral1
Sample
FOBS_B_ver1.05.zip
Resource
win11-20231215-en
General
-
Target
FOBS_B_ver1.05.zip
-
Size
41.2MB
-
MD5
bbbd1c369a2f26ed7d1c6eb155a4dfea
-
SHA1
13101333286ea293f001ac10aac9d33d80220346
-
SHA256
76cd23f617ad996222dc07723df0dcb1583502d5ea99249c037b64c7923d9be6
-
SHA512
208414a0dd8ad7897a3acd285a21c55203e9e2f13f8a2a0e150f97154dbd7a1ca670de376e659e744b4f64fed27e72537d87e1e1be702d05f9715a14d6a13cc6
-
SSDEEP
786432:+Puja0OT3iHlaEWMwHe/0tHl/qB68Eo21Z/xxAiOv/NsFVNMX:hj0Tg4EPt/K/aFo2iOv/NsFVG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/FOBS_B_ver1.05/FOBS_B_ver1.05/FOBS_B_ver1.05.exe
Files
-
FOBS_B_ver1.05.zip.zip
-
FOBS_B_ver1.05/FOBS_B_ver1.05/FOBS_B_ver1.05.actbin
-
FOBS_B_ver1.05/FOBS_B_ver1.05/FOBS_B_ver1.05.actstr
-
FOBS_B_ver1.05/FOBS_B_ver1.05/FOBS_B_ver1.05.exe.exe windows:4 windows x86 arch:x86
c948c7292a2d330b994a56de77abc32e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetPrivateProfileIntW
lstrcpyW
Sleep
GetOEMCP
GetLastError
LocalFree
FormatMessageW
GlobalFree
GlobalAlloc
ReadFile
CreateFileW
SetFilePointer
CloseHandle
CreateThread
WaitForSingleObject
TerminateThread
SizeofResource
LockResource
FindResourceW
LoadResource
GetModuleHandleW
CopyFileW
GetFileSize
DeleteFileW
WriteFile
FlushFileBuffers
CreateFileA
WritePrivateProfileStringW
GetStringTypeW
GetStringTypeA
LCMapStringW
GetModuleFileNameW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoA
InitializeCriticalSection
LoadLibraryA
RtlUnwind
HeapReAlloc
VirtualAlloc
IsValidCodePage
GetACP
GetCPInfo
LeaveCriticalSection
EnterCriticalSection
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
GetSystemTimeAsFileTime
OutputDebugStringW
FindFirstFileW
FindNextFileW
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
lstrlenW
VirtualFree
HeapCreate
HeapDestroy
DeleteCriticalSection
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
lstrcpynW
FindClose
GetFullPathNameW
LCMapStringA
MultiByteToWideChar
FreeEnvironmentStringsA
GetModuleFileNameA
GetStdHandle
ExitProcess
HeapSize
RaiseException
InterlockedDecrement
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoW
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
user32
EndDialog
SetWindowLongW
GetDlgItem
DialogBoxParamW
DispatchMessageW
PeekMessageW
GetKeyState
DefWindowProcW
SetMenuItemInfoW
PostMessageW
UnregisterClassW
DestroyMenu
AdjustWindowRect
LoadMenuW
UpdateWindow
PostQuitMessage
SendMessageW
GetWindowRect
ScreenToClient
LoadIconW
RegisterClassExW
SetCursor
DestroyWindow
GetMenu
GetDC
ReleaseDC
GetDesktopWindow
MessageBoxW
SetWindowPos
GetCursorPos
LoadStringW
GetMenuItemInfoW
ShowWindow
SetMenu
TranslateMessage
CreateWindowExW
gdi32
GetCharWidth32W
GetDeviceCaps
ole32
CoUninitialize
CoInitializeEx
imm32
ImmDisableIME
d3d9
Direct3DCreate9
d3dx9_39
D3DXVec2Normalize
D3DXCreateTextureFromResourceExW
D3DXCreateLine
D3DXCreateSprite
D3DXCreateFontW
D3DXMatrixMultiply
D3DXCreateTextureFromFileInMemoryEx
dsound
ord11
dinput8
DirectInput8Create
winmm
mmioClose
mmioOpenW
mmioAscend
timeBeginPeriod
timeGetDevCaps
mmioRead
mmioSeek
timeGetTime
mmioDescend
Sections
.text Size: 200KB - Virtual size: 197KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 451KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 712KB - Virtual size: 710KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
FOBS_B_ver1.05/FOBS_B_ver1.05/FOBS_B_ver1.05.ini
-
FOBS_B_ver1.05/FOBS_B_ver1.05/_memory1.actsave
-
FOBS_B_ver1.05/FOBS_B_ver1.05/readme/readme1.txt
-
FOBS_B_ver1.05/FOBS_B_ver1.05/readme/readme2.txt
-
FOBS_B_ver1.05/FOBS_B_ver1.05/readme/save/_memory1.actsave
-
FOBS_B_ver1.05/FOBS_B_ver1.05/readme/save/âZü[âuâfü[â^é╠ê°é½îpé¼ò√(Ägùpò√û@üj.txt
-
FOBS_B_ver1.05/FOBS_B_ver1.05/readme/translator.txt