4f72199be1bf7290f8e67949f75b518b381f0e6e8ac7b0f56403b885a644c1e6

Sharing

Copy URL Twitter E-mail

General

Target

4f72199be1bf7290f8e67949f75b518b381f0e6e8ac7b0f56403b885a644c1e6
Size

2.3MB
MD5

59e5245460a715364d5a19d496efcffe
SHA1

3d9a4cfa7517d3bd2015d81f6e223708bdccd1df
SHA256

4f72199be1bf7290f8e67949f75b518b381f0e6e8ac7b0f56403b885a644c1e6
SHA512

5ac63943383c0bf57aa93a65c56f22387227f3d93d03afb0a778eaf1dfb979a76e8684e226c51cd6a9a299d5f2dd0481ec7adc844f015df76cb55a56ed4d3cb8
SSDEEP

49152:69UJj87k/a4nQkh6ZISIyR7fJATyIeOgWfPfyDLmd/DIuJxThJqEB6ZmKYGCsWHt:18D4nQkhSRtATyIe+fPf6Lmd/DI0xT5x

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4f72199be1bf7290f8e67949f75b518b381f0e6e8ac7b0f56403b885a644c1e6

Files

4f72199be1bf7290f8e67949f75b518b381f0e6e8ac7b0f56403b885a644c1e6
.exe windows:5 windows x86 arch:x86

60892b288ccc180a39a95b6e54766716

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Faronics\morocco\Faronics_Hg\CLOUD\WebCon\Source\bin\Release\FWAWebInstaller\Win32\FWAWebInstaller.pdb

Imports

comctl32

ord17

shell32

SHGetSpecialFolderPathW
ShellExecuteExW
ord165
SHGetFolderPathW

crypt32

CryptBinaryToStringA

kernel32

DeleteVolumeMountPointW
FindNextVolumeW
RemoveDirectoryW
FindFirstVolumeW
GetVersionExW
GetFileAttributesW
GetCurrentProcessId
MoveFileExW
GetSystemWindowsDirectoryW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetTempPathW
GetPrivateProfileIntW
GetLocalTime
CreateEventW
GetSystemInfo
GetWindowsDirectoryW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
SystemTimeToFileTime
FileTimeToSystemTime
CreateThread
GetCurrentThreadId
SetVolumeMountPointW
WriteConsoleW
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
LoadLibraryW
IsValidCodePage
GetOEMCP
GetACP
GetLocaleInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
FlushFileBuffers
GetConsoleMode
GetConsoleCP
ExitProcess
HeapCreate
GetFileType
GetStdHandle
SetHandleCount
IsProcessorFeaturePresent
CreateDirectoryW
FindVolumeClose
CopyFileW
TerminateProcess
GetExitCodeProcess
SetLastError
GetUserDefaultLangID
ReadFile
SetEndOfFile
SetFilePointer
LocalFree
FindNextFileW
DeviceIoControl
LocalAlloc
FindClose
GetProcAddress
GetSystemDirectoryW
GetModuleHandleW
WaitForSingleObject
CreateProcessW
InterlockedDecrement
CloseHandle
CreateFileW
WriteFile
DeleteFileW
MoveFileW
GetLastError
lstrlenW
GetBinaryTypeW
GetModuleFileNameW
Sleep
WideCharToMultiByte
FindFirstFileW
LockResource
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
FindResourceExW
OutputDebugStringA
OutputDebugStringW
GetCurrentProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LCMapStringW
RtlUnwind
GetCPInfo
GetStartupInfoW
HeapSetInformation
GetCommandLineW
GetSystemTimeAsFileTime
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
InitializeCriticalSectionAndSpinCount
RaiseException
DeleteCriticalSection
DecodePointer
EncodePointer
GetStringTypeW
InterlockedExchange
InterlockedCompareExchange
InterlockedIncrement

user32

LoadIconW
DrawFocusRect
GetDC
SetFocus
GetClientRect
TrackMouseEvent
GetParent
DialogBoxParamW
InvalidateRect
DrawTextW
EndDialog
FillRect
GetWindowRect
SetTimer
GetDesktopWindow
ShowWindow
GetWindowTextW
SystemParametersInfoW
GetDlgItem
KillTimer
SetWindowLongW
LoadBitmapW
EnableWindow
GetDlgCtrlID
SetWindowTextW
wsprintfW
MessageBoxExW
ExitWindowsEx
SendMessageW
GetSystemMetrics
CallWindowProcW
PostMessageW
MoveWindow

gdi32

SetTextColor
DeleteDC
CreateFontIndirectW
GetCurrentObject
SetBkColor
SetBkMode
DeleteObject
SelectObject
CreateCompatibleDC
Rectangle
GetObjectW
CreatePen
CreateSolidBrush
BitBlt

advapi32

OpenSCManagerW
RegOpenKeyExW
RegFlushKey
RegCreateKeyA
RegQueryValueExA
RegSetValueExA
ReportEventW
DeregisterEventSource
RegisterEventSourceW
RegDeleteKeyW
RegCreateKeyExW
RegEnumValueW
SetNamedSecurityInfoW
FreeSid
SetEntriesInAclW
AllocateAndInitializeSid
SetNamedSecurityInfoA
QueryServiceStatusEx
LookupPrivilegeValueW
AdjustTokenPrivileges
GetTokenInformation
OpenProcessToken
QueryServiceConfigW
ControlService
QueryServiceStatus
StartServiceW
OpenServiceW
RegCloseKey
CloseServiceHandle
RegSetValueExW
RegEnumKeyExW
RegDeleteValueW
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExW

ole32

CoCreateInstance
CoSetProxyBlanket
CoUninitialize
CoInitializeSecurity
CoInitializeEx
CoInitialize
CLSIDFromProgID
CoQueryProxyBlanket

oleaut32

VariantCopy
SysAllocStringByteLen
SysStringByteLen
SysStringLen
VariantChangeType
VarCmp
SysAllocString
SafeArrayGetLBound
VariantClear
VariantInit
SafeArrayGetElement
SysFreeString
SafeArrayGetUBound

rpcrt4

UuidToStringW
RpcStringFreeW
UuidCreate

shlwapi

PathFileExistsW
PathCombineW

msi

ord32
ord8
ord92
ord125
ord20
ord17
ord163

winhttp

WinHttpReceiveResponse
WinHttpSetCredentials
WinHttpReadData
WinHttpCrackUrl
WinHttpOpenRequest
WinHttpOpen
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpCloseHandle
WinHttpConnect
WinHttpSendRequest
WinHttpSetOption
WinHttpSetTimeouts

Sections

.text
Size: 448KB - Virtual size: 447KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

60892b288ccc180a39a95b6e54766716

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

comctl32

shell32

crypt32

kernel32

user32

gdi32

advapi32

ole32

oleaut32

rpcrt4

shlwapi

msi

winhttp

Sections

.text Size: 448KB - Virtual size: 447KB

.rdata Size: 134KB - Virtual size: 133KB

.data Size: 11KB - Virtual size: 20KB

.rsrc Size: 1.6MB - Virtual size: 1.6MB

.reloc Size: 33KB - Virtual size: 32KB

.text
Size: 448KB - Virtual size: 447KB

.rdata
Size: 134KB - Virtual size: 133KB

.data
Size: 11KB - Virtual size: 20KB

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

.reloc
Size: 33KB - Virtual size: 32KB