Static task
static1
Behavioral task
behavioral1
Sample
PassFab for RAR.exe
Resource
win11-20240802-en
General
-
Target
PassFab for RAR.exe
-
Size
973KB
-
MD5
fa193fdcdd1016fded6c7c89c5c8e424
-
SHA1
2ce3b25d90ddbc4b5f8b7eabf81258565e9926b0
-
SHA256
1c76e70a7981c3eca3d30b386c8ac51996ad5394657da8fe06ee517315d960fc
-
SHA512
bc0465e9636e45b4e17ed22ba1c49b4613019ef7249ad1bf62804f6574ba83fab03f025303fe961ce03cff20d5b9a78f868777496f9eaa176ab95559ba90fb77
-
SSDEEP
24576:+Xpd5m71fQTAMUqQLtcZjaxIKK2LYAwpXbQKDtR:+Xvg71oUaQS7YYTXbntR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource PassFab for RAR.exe
Files
-
PassFab for RAR.exe.exe windows:6 windows x86 arch:x86
Password: 123
dc18dc0ed04e02b24125500fdcc015e1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
softwarelog
CreateExportObj
version
VerQueryValueW
sqlite3
sqlite3_step
passwordcrackerwrap
?FreePasswordCrackObj@PasswordCrackWrap@@YAXW4tagWrapPasswordCrackType@1@PAVIPasswprdCrack@@@Z
libcurl
curl_easy_init
bugsplat
??1MiniDmpSender@@UAE@XZ
register
?GetRegisterObj@@YAPAVIRegisterManager@@XZ
securitylaunch
?FreeAntiCrackObj@@YAXPAVIAntiCrack@@@Z
agentsupport
?GetLinkManagerObj@TSCommon@@YAPAVILinkManager@1@XZ
user32
GetDC
gdi32
LineTo
msimg32
AlphaBlend
winspool.drv
OpenPrinterW
advapi32
RegEnumKeyW
shell32
DragFinish
comctl32
_TrackMouseEvent
shlwapi
PathIsUNCW
uxtheme
IsAppThemed
ole32
DoDragDrop
oleaut32
VariantChangeType
oledlg
OleUIBusyW
gdiplus
GdipFree
oleacc
LresultFromObject
imm32
ImmGetContext
winmm
PlaySoundW
Sections
.MPRESS1 Size: 815KB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 152KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE