avira_fusebundlegen-win32-en[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

avira_fusebundlegen-win32-en.zip
Size

794KB
MD5

d615b6c057823089c9803ce19785dec0
SHA1

085b6fd2c0b1f775ae3f0e97256ec3ff9ba19354
SHA256

297c45cd3832ed04edacfa2a28c8677110dd1dc22421962128e29a7000697455
SHA512

f9443718f271bce5fa6c85f92e5eef0ce0dff88c2df147912f9acad37a74de379f197162e7fa9ed878ce316b965a6996803e2246909af8ea61948a3836a4bd68
SSDEEP

12288:tmZW6GiA+F0SNdhg1HQ94BB09kkWDWTbhtXMdGe0tqz4I23+dYxTlP0tCXiTZ7:QZW6dA+1dCZZB09umrXdj09yTGZd7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/fusebundle.exe

Files

avira_fusebundlegen-win32-en.zip
.zip

Password: infected
fusebundle.conf
fusebundle.exe
.exe windows:5 windows x86 arch:x86

Password: infected

bf6ab1a577d26f61f5c412f4978daa93

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

UnlockFileEx
SetUnhandledExceptionFilter
IsDebuggerPresent
UnlockFile
UnhandledExceptionFilter
GetLocaleInfoW
LockFileEx
LockFile
InterlockedCompareExchange
InterlockedDecrement
InterlockedIncrement
CreateMutexA
ReleaseSemaphore
CreateSemaphoreA
InterlockedExchange
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
TlsFree
SetErrorMode
LoadLibraryExW
LeaveCriticalSection
SetEvent
ReleaseMutex
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
CreateEventA
GetFileAttributesExW
RemoveDirectoryW
CreateDirectoryW
FindFirstFileW
FindNextFileW
DeleteFileW
SetStdHandle
GetFileInformationByHandle
DeviceIoControl
CancelIo
GetSystemTimeAsFileTime
SetCurrentDirectoryW
GetCurrentDirectoryW
GetFullPathNameW
GetDriveTypeW
GetDriveTypeA
GetVersionExA
GlobalMemoryStatus
QueryPerformanceCounter
FindClose
FlushConsoleInputBuffer
GetVersion
GetModuleHandleA
OutputDebugStringW
GetTimeFormatW
GetLocalTime
GetDateFormatW
GetConsoleScreenBufferInfo
GetOEMCP
GetACP
WideCharToMultiByte
SetFilePointer
WriteFile
ExpandEnvironmentStringsA
GetTickCount
Sleep
GetStdHandle
GetFileType
WaitForMultipleObjects
PeekNamedPipe
GetSystemDirectoryA
SleepEx
FormatMessageA
SetLastError
MultiByteToWideChar
TlsAlloc
TlsSetValue
LoadLibraryA
GetModuleFileNameW
GetWindowsDirectoryW
GetSystemDirectoryW
GetCurrentProcess
GetModuleHandleW
GetVersionExW
GetCurrentProcessId
GetComputerNameW
LoadLibraryW
GetProcAddress
OpenProcess
GlobalAlloc
GlobalFree
FreeLibrary
CreateProcessW
TerminateProcess
GetExitCodeProcess
CreateEventW
GetLastError
ReadFile
WaitForSingleObject
GetOverlappedResult
ResetEvent
CreateNamedPipeW
CreateFileW
SetHandleInformation
CloseHandle
GetCurrentThreadId
MoveFileExW
FormatMessageW
LocalFree

advapi32

ReportEventA
SetThreadToken
ImpersonateLoggedOnUser
GetUserNameW
DuplicateTokenEx
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyW
LookupAccountSidW
OpenProcessToken
GetTokenInformation
GetNamedSecurityInfoW
GetNamedSecurityInfoA
GetSecurityInfo
AllocateAndInitializeSid
GetEffectiveRightsFromAclW
FreeSid
RegisterEventSourceA
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RevertToSelf

iphlpapi

GetAdaptersInfo

mpr

WNetCancelConnection2W
WNetAddConnection2W

ws2_32

ntohl
freeaddrinfo
shutdown
gethostname
ioctlsocket
getaddrinfo
__WSAFDIsSet
listen
accept
recvfrom
sendto
getservbyport
gethostbyaddr
getservbyname
htonl
inet_ntoa
gethostbyname
inet_addr
WSASetLastError
socket
connect
setsockopt
getpeername
getsockopt
htons
bind
ntohs
getsockname
send
recv
WSAGetLastError
closesocket
WSAStartup
WSACleanup
select

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

msvcr90

__set_app_type
_except_handler4_common
_time32
_gmtime32
_stat32
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_crt_debugger_hook
?terminate@@YAXXZ
_invoke_watson
_controlfp_s
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__initenv
_XcptFilter
_cexit
__getmainargs
_amsg_exit
_endthreadex
_beginthreadex
__doserrno
_environ
_wenviron
modf
wcschr
_except_handler3
atoi
_stricmp
_strnicmp
_setmode
strcmp
_getch
_open
raise
_exit
vfprintf
_wsopen
_lseek
_read
_filelength
strftime
_mktime64
_localtime64_s
_gmtime64_s
_waccess
_fdopen
_vsnprintf
_fseeki64
_ftelli64
ftell
isgraph
isupper
islower
isalpha
toupper
getenv
_encode_pointer
isspace
isalnum
fflush
fputc
isdigit
fputs
qsort
fgets
_strtoi64
isxdigit
strtol
tolower
strtoul
_iob
fwrite
_sys_nerr
fseek
strrchr
_snwprintf
_snprintf
perror
wcsncat
iswctype
wcsspn
memmove
fopen
fread
ferror
feof
realloc
strncmp
strstr
strchr
sscanf
isprint
strncpy
wcsncmp
_wsplitpath
mbstowcs
_close
_wopen
wcsncpy
_wcsupr
wcsstr
_errno
strerror
memcpy
_swprintf
sprintf
malloc
calloc
free
swscanf
_wfopen
fclose
_wtoi
srand
rand
wcsrchr
_time64
_wcsicmp
fwprintf
printf
exit
signal
memset
__iob_func
fprintf
_getpid
_strdup
_fstat32
_fileno
_isatty
__p__fmode
memchr
__p__commode

user32

GetDesktopWindow
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxA

shell32

SHGetFolderPathW
CommandLineToArgvW

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 308KB - Virtual size: 307KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 62KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
fusebundle_msg.avr

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

bf6ab1a577d26f61f5c412f4978daa93

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

iphlpapi

mpr

ws2_32

version

msvcr90

user32

shell32

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 308KB - Virtual size: 307KB

.data Size: 62KB - Virtual size: 73KB

.rsrc Size: 25KB - Virtual size: 24KB

.reloc Size: 64KB - Virtual size: 63KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 308KB - Virtual size: 307KB

.data
Size: 62KB - Virtual size: 73KB

.rsrc
Size: 25KB - Virtual size: 24KB

.reloc
Size: 64KB - Virtual size: 63KB