WerFault[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

WerFault.exe
Size

353KB
MD5

6d0fdf045b7c8ff1dbc1f5f1518417d1
SHA1

322cf6eef576e268e4b9dd4abb843f7ffc876da9
SHA256

022847e7c06b133fe995bdfe4bb658ac3619e2182f765a4c406c4dc3b284ce2b
SHA512

36b8a7567b9329a7c53b7eb2e5525905d59211bf03699aa46c398ccb0126f3d6885e3344dec1b99fab8428ae66037ad982e44f1932fa469ec6eecf3a7c66f630
SSDEEP

6144:IT3SEDWmlzsDlxb5MU9Rz+nosrBFy2b6kVJyB60OHyLC7vj1VZK:IjbDWmuDl9vzQosO2b7c2Hywr1Vw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WerFault.exe

Files

WerFault.exe
.exe windows:6 windows x86 arch:x86

69cf6cd3d00b59a74008ea803488a533

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

WerFault.pdb

Imports

advapi32

TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
MD5Init
MD5Update
MD5Final
RegSetKeyValueW
EventRegister
EventWrite
EventUnregister
ConvertSidToStringSidW
GetSidSubAuthorityCount
GetSidSubAuthority
EqualSid
RegisterWaitChainCOMCallback
OpenThreadWaitChainSession
GetThreadWaitChain
CloseThreadWaitChainSession
GetKernelObjectSecurity
GetSecurityDescriptorDacl
OpenThreadToken
SetEntriesInAclW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetKernelObjectSecurity
GetTokenInformation
IsValidSid
GetLengthSid
CopySid
DuplicateToken
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
StopTraceW
QueryTraceW
StartTraceW
EnableTrace
RegOpenKeyW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
RegDeleteKeyW
CreateProcessAsUserW
OpenProcessToken

kernel32

CreateProcessW
GetModuleFileNameW
RegEnumKeyExW
DeleteFileW
RegEnumValueW
FileTimeToSystemTime
WriteFile
GetFileAttributesExW
FindClose
FindNextFileW
FindFirstFileW
CreateFileW
RegGetValueW
RegQueryValueExW
GetSystemDefaultLangID
GetProductInfo
GetSystemInfo
LocalFree
MoveFileExW
SetFileAttributesW
GetDiskFreeSpaceExW
ReadFile
GetLocalTime
CreateDirectoryW
SetPriorityClass
OpenProcess
DeviceIoControl
GetFileAttributesW
ReadProcessMemory
LoadLibraryW
SystemTimeToFileTime
GetSystemTime
FreeLibraryAndExitThread
GetExitCodeThread
CreateThread
GetModuleHandleExW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
HeapFree
HeapAlloc
GetProcessHeap
OpenFileMappingW
DuplicateHandle
LoadLibraryExW
QueryFullProcessImageNameW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetThreadUILanguage
GetNativeSystemInfo
SearchPathW
IsWow64Process
GetSystemDirectoryW
GetUserDefaultUILanguage
GetProcessTimes
GetApplicationRestartSettings
MultiByteToWideChar
lstrlenW
FormatMessageW
GetWindowsDirectoryW
GetSystemWow64DirectoryW
GetFileSize
ExpandEnvironmentStringsW
WaitForMultipleObjects
GetFileInformationByHandle
GetFinalPathNameByHandleW
SetFileInformationByHandle
GetLongPathNameW
GetTempPathW
GetTempFileNameW
GetFileSizeEx
CheckRemoteDebuggerPresent
RegQueryInfoKeyW
VirtualQuery
SetEvent
GetPriorityClass
GetModuleHandleW
SetEnvironmentVariableW
CreateEventW
GetStringTypeExW
ResetEvent
K32GetModuleFileNameExW
Thread32Next
OpenThread
Thread32First
InitializeCriticalSection
SetThreadpoolWait
EnterCriticalSection
LeaveCriticalSection
GetThreadContext
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
GetProcessId
DeleteCriticalSection
CreateThreadpoolWait
GetProcessIoCounters
GetThreadTimes
GetThreadId
GetProcessIdOfThread
LCMapStringW
OutputDebugStringA
VirtualFree
VirtualAlloc
InterlockedIncrement
InterlockedDecrement
OpenEventW
K32EnumProcessModules
GlobalMemoryStatus
Module32NextW
Module32FirstW
QueryDosDeviceW
GetLogicalDriveStringsW
GetDriveTypeW
FindNextFileNameW
FindFirstFileNameW
CompareFileTime
FindFirstFileExW
GetCurrentThread
GetThreadPriority
SetThreadPriority
WTSGetActiveConsoleSessionId
GetVersionExW
SetLastError
RegDeleteValueW
RegCloseKey
OpenMutexW
GetCommandLineW
CloseHandle
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
Sleep
InterlockedExchange
SetErrorMode
HeapSetInformation
WaitForSingleObject
GetProcAddress
InitializeCriticalSectionAndSpinCount
ReleaseMutex
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
CompareStringW
CreateMutexW
GetLastError
FreeLibrary
InterlockedCompareExchange
LoadLibraryExA
DelayLoadFailureHook

user32

GetProcessWindowStation
LoadStringW
DispatchMessageW
TranslateMessage
IsHungAppWindow
GetClassNameW
GetWindow
IsWindowEnabled
GetWindowThreadProcessId
SendMessageW
SetWindowPos
GetWindowLongW
GetThreadDesktop
EnumWindows
MonitorFromPoint
GetSystemMetrics
LogicalToPhysicalPoint
GetMonitorInfoW
MonitorFromWindow
IsIconic
GetWindowRect
SetWindowLongW
EndDialog
PostMessageW
LoadIconW
DefWindowProcW
RegisterErrorReportingDialog
CheckWindowThreadDesktop
IsWindow
GetUserObjectInformationW
GetMessageW
RegisterWindowMessageW
ShowWindow
CreateWindowExW
RegisterClassExW
ChangeWindowMessageFilter

msvcrt

iswspace
wcspbrk
_CxxThrowException
memcpy
wcsstr
_wcstoui64
_purecall
_vsnprintf
wcsncmp
_vscwprintf
tolower
towlower
??1type_info@@UAE@XZ
memmove
_wcsnicmp
_wtoi64
_exit
_XcptFilter
exit
_initterm
isspace
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_except_handler4_common
_controlfp
__wgetmainargs
_vsnwprintf
__CxxFrameHandler3
wcschr
_wcsicmp
memset
??3@YAXPAX@Z
??2@YAPAXI@Z
wcsrchr
_wtoi
_unlock
__dllonexit
_lock
_onexit
_cexit

ntdll

RtlCreateProcessReflection
WinSqmAddToStream
WinSqmSetString
RtlFreeHeap
RtlAllocateHeap
NtSetSystemInformation
RtlAdjustPrivilege
NtQueryObject
NtSystemDebugControl
WinSqmIncrementDWORD
NtSuspendProcess
NtResumeProcess
NtQuerySystemInformation
RtlUpcaseUnicodeChar
RtlCompareMemory
ShipAssert
WinSqmEndSession
WinSqmStartSession
WinSqmSetDWORD
NtQueryInformationThread
NtQueryEvent
RtlImageNtHeaderEx
RtlAllocateAndInitializeSid
RtlInitUnicodeString
NtAlpcConnectPort
NtAlpcSendWaitReceivePort
RtlFreeSid
NtOpenEvent
NtWaitForSingleObject
NtClose
EtwEventWriteNoRegistration
RtlNtStatusToDosError
NtQueryInformationProcess
NtQueryInformationToken
EtwTraceMessage
DbgPrint

ole32

CoGetCallState
CoUninitialize
CoCreateInstance
CoInitialize
CoGetActivationState
CoGetObject
StringFromGUID2
CoSetProxyBlanket
CoTaskMemFree
ProgIDFromCLSID
CLSIDFromString
CoCreateGuid

oleaut32

SysAllocStringLen
SysFreeString

shlwapi

ord437

imm32

ImmDisableIME

wer

WerpAddAppCompatData
WerpReportCancel
WerReportCreate
WerpSetIntegratorReportId
WerpGetReportConsent
WerpSetCallBack
WerpAddRegisteredDataToReport
WerReportSetUIOption
WerReportSubmit
WerReportCloseHandle
WerpAddFile
WerpPromtUser
WerpAddSecondaryParameter
WerReportAddDump
WerpSetEventName
WerpSetDynamicParameter
WerReportSetParameter
WerpIsTransportAvailable
WerpGetReportFlags
WerpSetReportFlags
WerpGetNumFiles
WerpGetFileByIndex
WerpCreateIntegratorReportId
WerReportAddFile
WerpFreeString

comctl32

ord410
ord412
ord345
ord413

faultrep

WerpInitiateCrashReporting

Sections

.text
Size: 243KB - Virtual size: 243KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

69cf6cd3d00b59a74008ea803488a533

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

msvcrt

ntdll

ole32

oleaut32

shlwapi

imm32

wer

comctl32

faultrep

Sections

.text Size: 243KB - Virtual size: 243KB

.data Size: 2KB - Virtual size: 3KB

.rsrc Size: 85KB - Virtual size: 85KB

.reloc Size: 20KB - Virtual size: 20KB

.text
Size: 243KB - Virtual size: 243KB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 85KB - Virtual size: 85KB

.reloc
Size: 20KB - Virtual size: 20KB