fabookie | PE[.]#462cc

Sharing

Copy URL Twitter E-mail

General

Target
PE.#462cc
Size 1.2MB
Sample240125-s8bj4saac4
SHA256 636ee30a359c26e082c2418b22220ee358efe404db799e27d981bea2b19837bf
MD5 355ed7b82bc753a4e0325451108b3ac7
SHA1 5fbf27267ccd8f1a4bb10a233daf8173a9f8c50e
SHA512 de153c490cefcb1347985a6a7e7a2f4e374562203e1ec15f4ed728fd106a9fb8c5d979b320949a3669546d834db83f031e54083ea6e6ba9ba3ced632f652f870
SSDEEP 24576:3C7CI9TZDEWk1wCy0zaG9cQAH1ftxmbfYQJZKaz+:7I99DEWVtQAHZmn0U
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

fabookie

Malware Config

Extracted

Family

fabookie

http://app.nnnaajjjgc.com/check/safe

Signatures

Detect Fabookie payload 1 IoCs

resource	yara_rule
sample	family_fabookie

Fabookie family
fabookie

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PE.#462cc

File Explorer

PE.#462cc

.dll 1.2MB

PE.#462cc

IMPHASH 105ecf61a8a6148d4982a8a8333756a5
SHA256 636ee30a359c26e082c2418b22220ee358efe404db799e27d981bea2b19837bf
MD5 355ed7b82bc753a4e0325451108b3ac7
SHA1 5fbf27267ccd8f1a4bb10a233daf8173a9f8c50e
SHA512 de153c490cefcb1347985a6a7e7a2f4e374562203e1ec15f4ed728fd106a9fb8c5d979b320949a3669546d834db83f031e54083ea6e6ba9ba3ced632f652f870
SSDEEP 24576:3C7CI9TZDEWk1wCy0zaG9cQAH1ftxmbfYQJZKaz+:7I99DEWVtQAHZmn0U
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Detect Fabookie payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

566056

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

LocalFree AreFileApisANSI ReadFile TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW WriteFile GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW WaitForSingleObject CreateFileW GetFileAttributesW GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize MultiByteToWideChar GetTempPathA GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW CreateFileA LoadLibraryA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc CloseHandle GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress GetLastError LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId GetProcessHeap SystemTimeToFileTime FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers CreateToolhelp32Snapshot Module32FirstW ExitProcess LoadResource LockResource FormatMessageW Sleep CreateFileMappingA lstrlenW GetStringTypeW CompareStringEx InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx GetCPInfo InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW GetModuleHandleW InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess SetLastError QueryPerformanceFrequency RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList RtlPcToFileHeader RaiseException TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetModuleFileNameW GetStdHandle GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetFileSizeEx SetFilePointerEx GetConsoleOutputCP GetConsoleMode ReadConsoleW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW FindResourceA SizeofResource RtlUnwind

user32

GetWindowThreadProcessId GetWindow IsWindowVisible GetDesktopWindow SendMessageW

advapi32

RegCloseKey RegOpenKeyExW RegCreateKeyW

shell32

SHGetFolderPathW

winhttp

WinHttpQueryAuthSchemes WinHttpGetProxyForUrl WinHttpCloseHandle WinHttpConnect WinHttpQueryDataAvailable WinHttpSetOption WinHttpOpenRequest WinHttpGetIEProxyConfigForCurrentUser WinHttpReadData WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpReceiveResponse WinHttpOpen WinHttpSendRequest

crypt32

CryptUnprotectData