Yeni WinRAR archive.rar
- SHA256 cd7bab6008a75858061401d632b05cb953f9da467a2d1866a3a822d83a379aad
Behavioral task
behavioral1
Sample
Injector.exe
Resource
win10-20240404-en
windows10-1703-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Injector.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
fata.dll
Resource
win10-20240404-en
windows10-1703-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
fata.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target Yeni WinRAR archive.rar
- Size 9.8MB
- Sample240826-mpyyea1bpr
- SHA256 cd7bab6008a75858061401d632b05cb953f9da467a2d1866a3a822d83a379aad
- MD5 0da8dc4354cda635c9acabb535deb7f9
- SHA1 67fefc963faae27bffb9b74979ab1ee24c863a69
- SHA512 5649902e7a6bf3142c737c06e4afc2f043dfb90ddb64c68db14be5c7fa6d576b9b54dcfd50d497f0a4063ea34afe44d5d1e4b67e2cb264a2a8ed05d597674dbd
- SSDEEP 196608:vhcFc0jw7EF8ccUhACJuBBWZfYRs+1Be24het1crHN4XqGTP7j:vhcK087wKUeCJuBU042+bSqGv
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Erbium family
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Injector.exe unpack001/fata.dll
File Explorer
-
Yeni WinRAR archive.rar.rar 9.8MB
-
Injector.exe.exe 18KB
-
fata.dll.dll 36.2MB
Injector.exe
- IMPHASH 7f92caa5163ed08ccbe113a16149d174
- SHA256 5c30159bd9e53f314323cef7138acc415565babb54d67945b97157069506eef0
- MD5 209a747cf674b73c4cb16c09f2f4cb19
- SHA1 cca39fefe25d4e95e32b327c8159cc085e300a25
- SHA512 6c7c8ca25095636385aedaa6d09d13c502881a85256889d099c4b43a4ee8061b320ae18edbd32c04dccdcaa4ead263799d032f47d6727d9c5e59c2f5f11fa432
- SSDEEP 384:epjiVZpfacVBYQul/xgNpUzwPFOO9JMJ7iz2+baDxG080da:eKNogzOGJMR+2+baDxG+k
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
9223
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\Нужное\КСГО\Сурсы\load-lib-injector-master\Release\Injector.pdb
kernel32
Process32First
WriteProcessMemory
SetConsoleTitleA
Module32Next
GetFullPathNameA
OpenProcess
CreateToolhelp32Snapshot
Sleep
LoadLibraryA
Process32Next
CloseHandle
LoadLibraryW
GetProcAddress
VirtualAllocEx
CreateRemoteThread
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
UnhandledExceptionFilter
msvcp140
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??Bid@locale@std@@QAEIXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?id@?$ctype@D@std@@2V0locale@2@A
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?_Xlength_error@std@@YAXPBD@Z
vcruntime140
memset
_CxxThrowException
strstr
__std_terminate
__std_exception_copy
__std_exception_destroy
_except_handler4_common
__CxxFrameHandler3
memcpy
api-ms-win-crt-runtime-l1-1-0
exit
_initialize_onexit_table
_register_onexit_function
_register_thread_local_exe_atexit_callback
_exit
_controlfp_s
terminate
_invalid_parameter_noinfo_noreturn
_initterm_e
_c_exit
__p___argv
__p___argc
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_cexit
_set_app_type
_seh_filter_exe
_crt_atexit
_initterm
api-ms-win-crt-stdio-l1-1-0
fopen
__p__commode
_set_fmode
fclose
api-ms-win-crt-heap-l1-1-0
free
_callnewh
malloc
_set_new_mode
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
940B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=12, id=260, version=26706,
count=1, id=259, version=26706,
count=24, id=261, version=26706,
count=4, id=257, version=26706,
count=3, id=257, version=26213,
count=103, id=1, productName=Unmarked objects,
count=1, id=265, version=27045,
count=1, id=255, version=27045,
count=1, id=258, version=27045,
fata.dll
- IMPHASH 6f914c83ee8732aa4353c085e5e29778
- SHA256 74a00336a08201483ce04dc30891b077b614cd5023336efac17a5aaa9ddd8b8e
- MD5 36a3ff324f2fe1a9e71f40bf575c936c
- SHA1 f1ef1d289021000c2f742e7b38518bb0fdbde905
- SHA512 d4a3753e3261239a45ff54091274c4eafda834387eb7221bd0aa6b6a2d8170f9ba68d07c623903a562ef5f07aff51bfbc214bc93771396027ebba2c1a0e06b2d
- SSDEEP 393216:w/SBskEyrtN+zJkGsF20dH5ZXtpKjzw1QxgvLqmNAmjpy:UArtN+zJkGsF2OZZXuv4GcLjp
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4266218
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
E:\___\old\fatality recrack fix\Release\fagality.pdb
kernel32
SizeofResource
VirtualProtect
VirtualAlloc
FindResourceA
GetModuleHandleA
AttachConsole
LoadLibraryA
LockResource
CreateThread
LoadResource
GetProcAddress
GetCurrentProcessId
AllocConsole
VirtualQuery
VirtualFree
HeapCreate
HeapFree
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
HeapReAlloc
CloseHandle
HeapAlloc
GetThreadContext
GetModuleHandleW
FlushInstructionCache
SetThreadContext
OpenThread
WriteConsoleW
SetEndOfFile
ReadConsoleW
ReadFile
HeapSize
CreateFileW
SetFilePointerEx
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
GetStringTypeW
GetCPInfo
SetLastError
FreeLibrary
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
RaiseException
InterlockedFlushSList
GetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
LCMapStringW
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetStdHandle
GetFileSizeEx
shell32
ShellExecuteA
ws2_32
recv
connect
send
Name
.text
Size
4.1MB
Virtual Size
4.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
169KB
Virtual Size
169KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
31.9MB
Virtual Size
31.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=259, version=30795,
count=163, id=261, version=30795,
count=22, id=260, version=30795,
count=24, id=259, version=33731,
count=18, id=260, version=33731,
count=2, id=29, version=9254,
count=71, id=261, version=33731,
count=7, id=257, version=30795,
count=122, id=1, productName=Unmarked objects,
count=7, id=265, version=33811,
count=1, id=255, version=33811,
count=1, id=151,
count=1, id=258, version=33811,