fa6edb39423e4f66a2d771238f5bd300N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

fa6edb39423e4f66a2d771238f5bd300N.exe
Size

1.2MB
MD5

fa6edb39423e4f66a2d771238f5bd300
SHA1

0840f1216a34922d74c4a7a3e79d5091b8568a92
SHA256

b87bbc44c605cf351eee321b2b9bee74c4844902bd9fd105b045ab60c35bc9a3
SHA512

0ea33da60b40009ff9301cd02c72777c24bc4a5e8d91dfe8c7786901d603cb6d3900038045ef9cca89ee0c749f3c55eebe31f5c4c5c8b2cccd95e95c4e180888
SSDEEP

24576:zumiSIP/Sx4WetV2t9o33JsqjnhMgeiCl7G0nehbGZpbD:zwSIs4Weio33NDmg27RnWGj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fa6edb39423e4f66a2d771238f5bd300N.exe

Files

fa6edb39423e4f66a2d771238f5bd300N.exe
.exe windows:10 windows x64 arch:x64

3b02b1a32205a0365357ebed0574cce4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

FXSSVC.pdb

Imports

advapi32

TraceMessage
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
ConvertStringSidToSidW
RegCloseKey
RegDeleteValueW
EqualSid
RegOpenKeyExW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
StartServiceCtrlDispatcherW
DestroyPrivateObjectSecurity
RegisterServiceCtrlHandlerW
SetServiceStatus
GetLengthSid
IsValidSid
LogonUserW
DuplicateToken
MapGenericMask
AccessCheckAndAuditAlarmW
RegCreateKeyExW
IsValidSecurityDescriptor
GetSecurityDescriptorControl
GetSecurityDescriptorLength
RegSetValueExW
MakeSelfRelativeSD
OpenProcessToken
CreatePrivateObjectSecurity
RegQueryValueExW
OpenThreadToken
GetTokenInformation
SetPrivateObjectSecurity
GetPrivateObjectSecurity
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteKeyW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CheckTokenMembership
PerfSetCounterRefValue
PerfStopProvider
PerfStartProviderEx
PerfCreateInstance
PerfSetCounterSetInfo
RegDeleteKeyExW
RevertToSelf
ImpersonateLoggedOnUser
SetSecurityDescriptorDacl
RegNotifyChangeKeyValue
GetSecurityDescriptorDacl
QueryServiceStatus
SetSecurityDescriptorOwner
CloseServiceHandle
OpenSCManagerW
AllocateAndInitializeSid
SetEntriesInAclW
ControlService
GetSecurityDescriptorOwner
EnumDependentServicesW
FreeSid
InitializeSecurityDescriptor
OpenServiceW
SetSecurityDescriptorGroup
RegEnumKeyW
LookupPrivilegeValueW
AdjustTokenPrivileges
CopySid
LookupAccountSidW
LookupAccountNameW

kernel32

DelayLoadFailureHook
ResolveDelayLoadedAPI
LoadLibraryExW
lstrlenA
MulDiv
GetModuleFileNameW
OpenEventW
GetTimeFormatW
EnumUILanguagesW
GetLocaleInfoEx
GetStringTypeExW
OutputDebugStringW
GetSystemDirectoryW
GetFileType
GetTempFileNameW
SetFileInformationByHandle
GetFileInformationByHandle
CreateFileW
GetTempPathW
GetFinalPathNameByHandleW
GetDateFormatW
WideCharToMultiByte
MultiByteToWideChar
ExpandEnvironmentStringsW
CompareStringW
GetVersionExW
InitializeCriticalSectionAndSpinCount
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
OutputDebugStringA
TerminateProcess
UnhandledExceptionFilter
GetStartupInfoW
GetLastError
LoadLibraryW
GetProcessHeap
HeapCreate
lstrcmpiW
GetProcAddress
SetLastError
FileTimeToSystemTime
UnmapViewOfFile
CloseHandle
FindFirstFileW
FindClose
LocalFree
GetSystemTimeAsFileTime
DeleteFileW
FindNextFileW
EnterCriticalSection
LeaveCriticalSection
SetEvent
WaitForMultipleObjects
WaitForSingleObject
CreateEventW
GetFileAttributesW
RemoveDirectoryW
CreateDirectoryW
CopyFileW
Sleep
VirtualFree
GetFileSize
WriteFile
ReadFile
PostQueuedCompletionStatus
LocalAlloc
CreateSemaphoreW
InitializeCriticalSection
HeapSetInformation
GetVersion
DeleteCriticalSection
SetProcessMitigationPolicy
SetErrorMode
SetUnhandledExceptionFilter
CreateThread
GetComputerNameW
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
GetFileSizeEx
SetFilePointer
GetFileTime
FileTimeToLocalFileTime
lstrcmpW
ResetEvent
GetSystemTimeAdjustment
GetModuleHandleW
CreateWaitableTimerW
GetExitCodeThread
GetCurrentThread
HeapFree
GetCurrentProcess
HeapAlloc
ReleaseSemaphore
GetFullPathNameW
SetWaitableTimer
HeapDestroy
GetSystemTime
MoveFileW
SystemTimeToFileTime
SetFileTime
FormatMessageW
GetLocalTime
SetThreadExecutionState
GetQueuedCompletionStatus
CreateIoCompletionPort
CancelWaitableTimer
FreeLibrary

msvcrt

memcpy
memmove
realloc
??1exception@@UEAA@XZ
_vsnwprintf
wcsrchr
memcmp
memcpy_s
??0exception@@QEAA@AEBV0@@Z
?what@exception@@UEBAPEBDXZ
__CxxFrameHandler3
_wcsnicmp
swscanf
wcschr
iswalpha
_wsplitpath_s
__C_specific_handler
wcsnlen
_wcsicmp
memset
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_commode
_fmode
_wcmdln
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_CxxThrowException
??0exception@@QEAA@AEBQEBDH@Z
malloc
free
_callnewh
_purecall
qsort
_ltow
wcsstr
_itow
wcsncmp
wcsspn
??0exception@@QEAA@XZ
memmove_s
??0exception@@QEAA@AEBQEBD@Z
swscanf_s
_wcsnset
wcscmp

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

shlwapi

ord487
SHCopyKeyW

rpcrt4

RpcServerUnregisterIf
RpcServerListen
RpcMgmtStopServerListening
RpcServerUnregisterIfEx
RpcImpersonateClient
RpcRevertToSelf
RpcRevertToSelfEx
NdrClientCall3
NdrServerCall2
NdrServerCallAll
I_RpcBindingIsClientLocal
RpcBindingServerFromClient
RpcMgmtWaitServerListen
RpcServerRegisterIfEx
RpcServerUseProtseqEpW
RpcBindingInqAuthClientW
RpcBindingSetOption
RpcBindingSetAuthInfoExW
RpcStringFreeW
I_RpcExceptionFilter
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcBindingFree
RpcStringBindingParseW
RpcServerRegisterAuthInfoW
RpcBindingToStringBindingW

tapi32

lineShutdown
lineHandoffW
lineDeallocateCall
lineGetLineDevStatus
lineNegotiateAPIVersion
lineClose
lineOpenW
lineSetStatusMessages
lineInitializeExW
lineSetAppPriorityW
lineTranslateAddressW
lineGetCountryW
lineGetCallInfoW
lineGetDevCapsW

gdi32

SaveDC
SelectObject
StartPage
PlayEnhMetaFile
SetEnhMetaFileBits
CreateDCW
SetWindowOrgEx
CreateRectRgnIndirect
GetEnhMetaFileHeader
SetWindowExtEx
DeleteEnhMetaFile
SetViewportExtEx
GetDeviceCaps
DeleteDC
SetTextColor
SetBkMode
SelectClipRgn
RestoreDC
LPtoDP
DeleteObject
SetMapMode
CreateFontIndirectW
StartDocW
EndPage
EndDoc
EnableEUDC

winspool.drv

FindClosePrinterChangeNotification
GetPrinterW
ClosePrinter
FindFirstPrinterChangeNotification
FindNextPrinterChangeNotification
SetPrinterW
DocumentPropertiesW
EnumPrintersW
OpenPrinterW

user32

SendMessageW
FindWindowW
DrawTextW
LoadStringW

ole32

IIDFromString
CoUninitialize
CoInitializeEx
CoTaskMemFree
CLSIDFromString
CoCreateInstance
OleRun
StringFromIID
FreePropVariantArray
StgOpenStorageEx
StringFromGUID2

oleaut32

SysFreeString
GetErrorInfo
VariantInit
SysStringByteLen
SysAllocStringByteLen
SysAllocString
SysStringLen
VariantChangeType
VariantClear

shell32

SHGetFolderPathAndSubDirW
SHGetFolderPathW
SHSetLocalizedName

crypt32

CryptProtectData
CryptUnprotectData
CryptHashMessage

credui

CredUIParseUserNameW

fxstiff

TiffAddMsTags
MergeTiffFiles
TiffClose
TiffRecoverGoodPages
TiffPostProcessFast
MmrAddBranding
FXSTIFFInitialize
TiffExtractFirstPage
GetMsTagFileTime
GetMsTagDwordLong
GetMsTagString
MemoryMapTiffFile
TiffOpen

ntdll

RtlCaptureContext
RtlValidRelativeSecurityDescriptor
WinSqmIncrementDWORD
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlIpv4StringToAddressExW
RtlIpv6StringToAddressExW

Sections

.text
Size: 520KB - Virtual size: 519KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 93KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3b02b1a32205a0365357ebed0574cce4

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

msvcrt

version

shlwapi

rpcrt4

tapi32

gdi32

winspool.drv

user32

ole32

oleaut32

shell32

crypt32

credui

fxstiff

ntdll

Sections

.text Size: 520KB - Virtual size: 519KB

.rdata Size: 93KB - Virtual size: 93KB

.data Size: 15KB - Virtual size: 18KB

.pdata Size: 12KB - Virtual size: 12KB

.didat Size: 512B - Virtual size: 16B

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 520KB - Virtual size: 519KB

.rdata
Size: 93KB - Virtual size: 93KB

.data
Size: 15KB - Virtual size: 18KB

.pdata
Size: 12KB - Virtual size: 12KB

.didat
Size: 512B - Virtual size: 16B

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 568KB - Virtual size: 572KB