fsavailux[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

fsavailux.exe
Size

36KB
MD5

e72a8eb104aa5f97f5e4f0d17ef9eb6f
SHA1

7f2c7528df0194d31e46f214b9028ef0a0c24077
SHA256

fbcd821683df0855291b806e5ce5dd9d536e05adbff15d6884e1933632c3cfab
SHA512

3e8a2457046db01f67b9864faf1e0e1102402b5b30e127b22d431895cc4359d23f723db66d89007e970eb8ec68a226bc9fcfbd8feae054edbf33bbd777bcc95a
SSDEEP

384:EASrQwea377MDqy3XDI5bTQGjKXtWgeWW:vSrDeW77MDzMZQGYy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fsavailux.exe

Files

fsavailux.exe
.exe windows:10 windows x64 arch:x64

b8405b23f655b93b5431e61b0384fc1c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

fsavailux.pdb

Imports

msvcrt

_commode
_fmode
_wcmdln
__C_specific_handler
_initterm
__setusermatherr
realloc
?terminate@@YAXXZ
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
free
_cexit
memset

advapi32

OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW

kernel32

GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
RtlLookupFunctionEntry
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
GetStartupInfoW
Sleep
FreeLibrary
GetProcAddress
LoadLibraryW
RtlVirtualUnwind
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
DeviceIoControl
CreateFileW
GetLastError
CloseHandle
RtlCaptureContext

user32

ExitWindowsEx

ifsutil

?IsEntryPresent@AUTOREG@@SAEPEBVWSTRING@@@Z
?PushEntry@AUTOREG@@SAEPEBVWSTRING@@@Z

ulib

??0ARRAY@@QEAA@XZ
?Initialize@FLAG_ARGUMENT@@QEAAEPEAD@Z
??0FLAG_ARGUMENT@@QEAA@XZ
?IsValueSet@ARGUMENT@@QEAAEXZ
??1OBJECT@@UEAA@XZ
?SetCaseSensitive@ARGUMENT_LEXEMIZER@@QEAAXE@Z
?PrepareToParse@ARGUMENT_LEXEMIZER@@QEAAEPEAVWSTRING@@@Z
?PutSwitches@ARGUMENT_LEXEMIZER@@QEAAXPEBD@Z
?Initialize@ARRAY@@QEAAEKK@Z
?DoParsing@ARGUMENT_LEXEMIZER@@QEAAEPEAVARRAY@@@Z
?Initialize@ARGUMENT_LEXEMIZER@@QEAAEPEAVARRAY@@@Z
??1ARGUMENT_LEXEMIZER@@UEAA@XZ
??0ARGUMENT_LEXEMIZER@@QEAA@XZ
?Initialize@STRING_ARGUMENT@@QEAAEPEAD@Z
??1STRING_ARGUMENT@@UEAA@XZ
??0STRING_ARGUMENT@@QEAA@XZ
?Strcat@WSTRING@@QEAAEPEBG@Z
?Initialize@WSTRING@@QEAAEPEBDK@Z
?Put@ARRAY@@UEAAEPEAVOBJECT@@@Z
??1ARRAY@@UEAA@XZ
??0DSTRING@@QEAA@XZ
?PutSeparators@ARGUMENT_LEXEMIZER@@QEAAXPEBD@Z
??1DSTRING@@UEAA@XZ

comctl32

TaskDialogIndirect

api-ms-win-core-com-l1-1-0

CoInitializeEx

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 300B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b8405b23f655b93b5431e61b0384fc1c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

kernel32

user32

ifsutil

ulib

comctl32

api-ms-win-core-com-l1-1-0

Sections

.text Size: 8KB - Virtual size: 6KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 4KB - Virtual size: 1KB

.pdata Size: 4KB - Virtual size: 300B

.rsrc Size: 4KB - Virtual size: 2KB

.reloc Size: 4KB - Virtual size: 44B

.text
Size: 8KB - Virtual size: 6KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 4KB - Virtual size: 1KB

.pdata
Size: 4KB - Virtual size: 300B

.rsrc
Size: 4KB - Virtual size: 2KB

.reloc
Size: 4KB - Virtual size: 44B