Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
2900-19-0x0000000003580000-0x00000000036AC000-memory.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2900-19-0x0000000003580000-0x00000000036AC000-memory.dll
Resource
win10v2004-20240226-en
General
-
Target
2900-19-0x0000000003580000-0x00000000036AC000-memory.dmp
-
Size
1.2MB
-
MD5
95c4647671982c1cab69209eaeeea35a
-
SHA1
64a58a3d66dfde28b759fc5bed5638ef01b67923
-
SHA256
caf80c838be93da4f810c1b305b82cd9350517d5cf5f3fe60b2ed29553294a95
-
SHA512
0e96f041054eeae968e36ee250b1097bb3d1ce0cd5fc0e2f70eaa3456e8eb97d4bced9e23b44a459bc6e1d0027426e70edfe44828da77b4b5affc9f760411b6e
-
SSDEEP
24576:cNcx9MBigTOL3ptaVw76X1huVXq3QVuGm4lZPVJKXql3411c:ceMBBTOLqM8QVuSZIao3
Malware Config
Extracted
fabookie
http://app.alie3ksgaa.com/check/safe
Signatures
-
Detect Fabookie payload 1 IoCs
resource yara_rule sample family_fabookie -
Fabookie family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2900-19-0x0000000003580000-0x00000000036AC000-memory.dmp
Files
-
2900-19-0x0000000003580000-0x00000000036AC000-memory.dmp.dll windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Sections
.text Size: 889KB - Virtual size: 889KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 211KB - Virtual size: 211KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 25KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ