fabookie | ca0aef7482908df28ea75b42f8b26236aecfcc5b37421fdc0d309cee15500506

Sharing

Copy URL Twitter E-mail

General

Target
ca0aef7482908df28ea75b42f8b26236aecfcc5b37421fdc0d309cee15500506
Size 6.8MB
Sample241104-rxgfjs1dpf
SHA256 ca0aef7482908df28ea75b42f8b26236aecfcc5b37421fdc0d309cee15500506
MD5 b96ce989c772a073b1bcc341a37787e3
SHA1 2c66915d1384818a982eacb364acb5e86c2a66fc
SHA512 d7094d7a93019235ec6fb193bb0df27063f761f11b6eb0ba38cf69c43db435e6355370106d3c2a87ac566ca4ebcd07ae68e1845047280995f7d35d2d1d430ff5
SSDEEP 196608:t86NetLpl2zCh3a3Dlrn7LKzwRfh1ZscQAedF1cHISas:O6NejMzChaDlrn7Lkkic0dF1Jc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

fabookie privateloader risepro

Malware Config

Signatures

Detect Fabookie payload 1 IoCs

resource	yara_rule
static1/unpack001/arnatic_4.exe	family_fabookie

Fabookie family
fabookie
Privateloader family
privateloader
Risepro family
risepro

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
unpack001/arnatic_2.exe
unpack001/arnatic_3.exe
unpack001/arnatic_4.exe
unpack001/arnatic_5.exe
unpack001/arnatic_6.exe
unpack001/arnatic_7.exe
unpack001/null.exe

File Explorer

ca0aef7482908df28ea75b42f8b26236aecfcc5b37421fdc0d309cee15500506

.zip 6.8MB
app.exe

.exe 4.5MB
arnatic_2.exe

.exe 323KB
arnatic_3.exe

.exe 680KB
arnatic_4.exe

.exe 972KB
arnatic_5.exe

.exe 780KB
arnatic_6.exe

.exe 387KB
arnatic_7.exe

.exe 397KB
null.exe

.exe 445KB

ca0aef7482908df28ea75b42f8b26236aecfcc5b37421fdc0d309cee15500506

SHA256 ca0aef7482908df28ea75b42f8b26236aecfcc5b37421fdc0d309cee15500506
MD5 b96ce989c772a073b1bcc341a37787e3
SHA1 2c66915d1384818a982eacb364acb5e86c2a66fc
SHA512 d7094d7a93019235ec6fb193bb0df27063f761f11b6eb0ba38cf69c43db435e6355370106d3c2a87ac566ca4ebcd07ae68e1845047280995f7d35d2d1d430ff5
SSDEEP 196608:t86NetLpl2zCh3a3Dlrn7LKzwRfh1ZscQAedF1cHISas:O6NejMzChaDlrn7Lkkic0dF1Jc
MD5 SHA1 SHA512 SSDEEP

app.exe

IMPHASH e621a9dda4bab203878bb79570221dd7
SHA256 0e2bcbe99b84383cfa549598d998bddce096daa94e1eb6dfbfa66d3cf12cc1e4
MD5 ea57c9a4177b1022ec4d053af865cbc9
SHA1 7ec0f509955223f91ff3f225bfdc53e5ec56a6d8
SHA512 a889aa2439957fb8d78c1d582f5f0a3c2a084e1e085ac1ef00a42d69d144599769c6bbb6c0ad24aaf310db9ac153b54970ec292cc75d1bacbb57c1f603297802
SSDEEP 98304:zCAdBEbQw8N1k4UvgFzDRLIvPJDh6GIJD7k5iIl7nTFrfspCYmQ4:/k58N1RJavmrJs5X7T9lXQ4
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

64:7a:49:a9:0e:6c:68:29:3e:43:25:57:bd:cb:cf:5a:1c:90:d0:07:82:e6:45:bd:46:ae:5e:0f:b7:5d:36:78

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

POSTALCODE=10051

Chains

Oct 29, 2024

Minor OS version

Major OS version

Entry point

5840

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\puhovumevaga yilih zoyurukelid\zex70\yifilubava\resusedaf\za.pdb

kernel32

GetCommandLineW EnumResourceNamesW SetVolumeLabelA SearchPathW FindFirstFileW TlsGetValue SetLocalTime GetDriveTypeW GetNumberOfConsoleInputEvents CallNamedPipeA InterlockedIncrement InterlockedDecrement InitializeSListHead GetProfileSectionA SetComputerNameW GetComputerNameW CreateDirectoryExA GetModuleHandleW GenerateConsoleCtrlEvent GetConsoleAliasesLengthA GetPrivateProfileStringW GetConsoleTitleA GetWindowsDirectoryA GetSystemWow64DirectoryA EnumResourceTypesA FindResourceExA GlobalAlloc AddRefActCtx GetVolumeInformationA Sleep ReadFileScatter GetConsoleWindow GetSystemTimeAdjustment GetVersionExW GlobalFlags GetBinaryTypeA TerminateProcess GetAtomNameW IsDBCSLeadByte ReadFile CompareStringW lstrlenW SetConsoleTitleA GlobalUnlock LCMapStringA VerifyVersionInfoW CreateDirectoryA InterlockedExchange GetFileSizeEx GetProcAddress FreeUserPhysicalPages OpenWaitableTimerA LoadLibraryA Process32FirstW OpenMutexA SetCalendarInfoW IsSystemResumeAutomatic SetConsoleOutputCP AddAtomW SetFileApisToANSI WriteProfileSectionW GetCommMask GetTapeParameters GetSystemInfo GetOEMCP SetConsoleCursorInfo CreateIoCompletionPort FreeEnvironmentStringsW FindNextFileW BuildCommDCBA GetCurrentDirectoryA CompareStringA ScrollConsoleScreenBufferA CopyFileExA DeleteFileA GetLastError MoveFileA GetCommandLineA GetStartupInfoA HeapValidate IsBadReadPtr RaiseException LeaveCriticalSection EnterCriticalSection SetStdHandle GetFileType WriteFile WideCharToMultiByte GetConsoleCP GetConsoleMode GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleFileNameW DeleteCriticalSection QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime ExitProcess GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle TlsAlloc TlsSetValue TlsFree SetLastError HeapDestroy HeapCreate HeapFree VirtualFree HeapAlloc HeapSize HeapReAlloc VirtualAlloc GetACP GetCPInfo IsValidCodePage InitializeCriticalSectionAndSpinCount WriteConsoleA GetConsoleOutputCP WriteConsoleW MultiByteToWideChar SetFilePointer RtlUnwind DebugBreak OutputDebugStringA OutputDebugStringW LoadLibraryW LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA CreateFileA CloseHandle FlushFileBuffers GetModuleHandleA

user32

GetMenuCheckMarkDimensions GetMenuInfo GetComboBoxInfo GetMenuBarInfo

arnatic_2.exe

IMPHASH 621d175e940c3f2ca7217a398b3c22a6
SHA256 d9d4fee430f16d00256908e81a7b735954cad46807da9cd40c28435e5bcf0105
MD5 69b2b0208246bf893409e69a862eef76
SHA1 839b1236dc249fa9f19f717ffb42896e09fd9d5e
SHA512 422762cbd84626f9bf95735479b6832f1970b8498e3f767275c62a9c94c7d46b4525b1af93f3925b2a0fb01bc73ec246792eab1ce02a9245f33cf8d02011e7d8
SSDEEP 6144:4rYjDIFTxzTnnKDLLFExp2HVfdwQlUb2Axn14ubuJEOEPKriC5:7jDcTxzTnKD8p2HVfGQUHF14ugAlu
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\felunawocovus\seruboviy_rehi.pdb

kernel32

EnumResourceNamesW SearchPathW FindFirstFileW TlsGetValue SetLocalTime GetDriveTypeW GetNumberOfConsoleInputEvents FindResourceExW CallNamedPipeA InterlockedIncrement InitializeSListHead GlobalLock SetComputerNameW GetComputerNameW GetCommProperties FreeEnvironmentStringsA SetTapeParameters GetModuleHandleW GenerateConsoleCtrlEvent GetConsoleAliasesLengthA GetPrivateProfileStringW GetConsoleTitleA GetCommandLineA GetSystemWow64DirectoryA CreateDirectoryExW InitializeCriticalSection GlobalAlloc AddRefActCtx GetVolumeInformationA Sleep ReadFileScatter GetSystemWindowsDirectoryA GetSystemTimeAdjustment GetVersionExW GlobalFlags GetBinaryTypeA TerminateProcess IsDBCSLeadByte ReadFile CompareStringW lstrlenW SetConsoleTitleA LCMapStringA VerifyVersionInfoW CreateDirectoryA InterlockedExchange GetFileSizeEx GetCurrentDirectoryW GetProcAddress SetVolumeLabelW WriteProfileSectionA FreeUserPhysicalPages BuildCommDCBW OpenWaitableTimerA LoadLibraryA Process32FirstW OpenMutexA SetConsoleOutputCP AddAtomW SetFileApisToANSI FindAtomA GetTapeParameters GetSystemInfo EnumResourceTypesW CreateIoCompletionPort FreeEnvironmentStringsW FindNextFileW RequestWakeupLatency GetConsoleCursorInfo ScrollConsoleScreenBufferA SetCalendarInfoA GetWindowsDirectoryW GetProfileSectionW CopyFileExA DeleteFileA FlushFileBuffers GetLastError MoveFileA GetStartupInfoA HeapValidate IsBadReadPtr RaiseException LeaveCriticalSection EnterCriticalSection SetStdHandle GetFileType WriteFile WideCharToMultiByte GetConsoleCP GetConsoleMode DeleteCriticalSection GetModuleFileNameW SetUnhandledExceptionFilter QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime InterlockedDecrement ExitProcess GetModuleFileNameA GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle TlsAlloc TlsSetValue TlsFree SetLastError HeapDestroy HeapCreate HeapFree VirtualFree HeapAlloc GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent HeapSize HeapReAlloc VirtualAlloc GetACP GetOEMCP GetCPInfo IsValidCodePage InitializeCriticalSectionAndSpinCount WriteConsoleA GetConsoleOutputCP WriteConsoleW MultiByteToWideChar SetFilePointer RtlUnwind DebugBreak OutputDebugStringA OutputDebugStringW LoadLibraryW LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA CreateFileA CloseHandle GetModuleHandleA

user32

GetMenuCheckMarkDimensions GetMenuInfo GetMenuBarInfo

arnatic_3.exe

IMPHASH a044253673528dd98a9dd008f2a6b058
SHA256 d8c28d07c365873b4e8332f057f062e65f2dd0cd4d599fd8b16d82eca5cf4247
MD5 7837314688b7989de1e8d94f598eb2dd
SHA1 889ae8ce433d5357f8ea2aff64daaba563dc94e3
SHA512 3df0c24a9f51a82716abb8e87ff44fdb6686183423d1f2f7d6bfb4cd03c3a18490f2c7987c29f3e1b2d25c48d428c2e73033998a872b185f70bb68a7aedb3e7c
SSDEEP 12288:Umn1vBXNJl0P3ZbcCAjqH0d5Q+qUH6wyZQMvvdgMiCIT:n1vJNJla39cGH0d+7sOlQCIT
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8275

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA GetProcAddress DecodePointer WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RaiseException RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetACP HeapFree HeapAlloc CloseHandle FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA CompareStringW LCMapStringW SetStdHandle GetFileType GetStringTypeW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers CreateFileW

user32

wsprintfW

ole32

CoInitialize CoUninitialize CoCreateInstance

arnatic_4.exe

IMPHASH bf5334edf7817996f04e881057327d72
SHA256 d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384
MD5 5668cb771643274ba2c375ec6403c266
SHA1 dd78b03428b99368906fe62fc46aaaf1db07a8b9
SHA512 135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a
SSDEEP 24576:r2FhEQuE3w782S+UWIO5/6TNkdBAnlXG6+Z1mbXRV:Q/3w782SzWn5/akUlXF+Z1IBV
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Detect Fabookie payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

244855

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\workspace\workspace_c\GjOGoOIgHJEwh52iJ_20\Release\GjOGoOIgHJEwh52iJ_20.pdb

kernel32

LocalFree SizeofResource GetLastError LockResource LoadResource FindResourceW WinExec WriteConsoleW FormatMessageW Sleep GetTempPathA lstrlenW HeapSize CreateFileW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation MultiByteToWideChar GetStringTypeW WideCharToMultiByte EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress CloseHandle SetEvent ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwind RaiseException FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile HeapReAlloc HeapFree HeapAlloc GetFileType GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW DeleteFileW ReadFile ReadConsoleW SetEndOfFile

advapi32

RegSetValueExW RegOpenKeyExW RegCreateKeyW RegCloseKey

winhttp

WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpAddRequestHeaders WinHttpQueryAuthSchemes WinHttpGetProxyForUrl WinHttpSendRequest WinHttpSetCredentials WinHttpConnect WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpOpen WinHttpGetIEProxyConfigForCurrentUser

arnatic_5.exe

IMPHASH 146d9834dca937c5740063d6c887d411
SHA256 46836190326258f65c9dbc1930b01e9d3de04996a1a2c79e39a36c281d79fe0a
MD5 fd4160bc3c35b4eaed8c02abd8e2f505
SHA1 3c7bcdc27da78c813548a6465d59d00c4dc75bba
SHA512 37e671e355c6a533c3273f2af12277b4457719e9b2d4fa9859386eae78010a9be6e63941f85b319ce5c9f98867f82a067bca16c208d2d38dee9f0fee0f656895
SSDEEP 24576:i77o8t0b5e8dzMdQG/6dfwun9elTFl64D:1jdgdR/+IunmTvxD
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

275110

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle FindClose lstrcatA GetModuleHandleA GlobalAlloc lstrcpyA VerSetConditionMask GetModuleHandleW WideCharToMultiByte VerifyVersionInfoW GetSystemTimeAsFileTime IsWow64Process GetComputerNameA GetProcAddress HeapFree lstrlenA LoadLibraryA HeapAlloc lstrcpynA GetProcessHeap GetLastError CreateFileW InitializeSListHead IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetCurrentProcess TerminateProcess FormatMessageW SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW DeleteFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle SetEndOfFile SetFilePointerEx SetLastError MultiByteToWideChar QueryPerformanceFrequency EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount CreateEventW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer DecodePointer GetCPInfo LCMapStringW GetLocaleInfoW GetStringTypeW GetCurrentThread GetThreadTimes RtlUnwind InterlockedPushEntrySList RaiseException FreeLibrary LoadLibraryExW GetFileType ExitProcess GetModuleHandleExW SetEnvironmentVariableW GetStdHandle GetModuleFileNameW WriteConsoleW GetConsoleMode ReadConsoleW GetConsoleOutputCP SetStdHandle IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx FlushFileBuffers HeapReAlloc OutputDebugStringW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW HeapSize WriteFile AreFileApisANSI ReadFile SetEvent ResetEvent WaitForSingleObjectEx

user32

CharToOemA CharNextA

advapi32

CryptGenRandom CryptAcquireContextA CryptReleaseContext ConvertSidToStringSidA LookupAccountNameA

arnatic_6.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 e607c6376ebb6db55e15852b51dfe666a09eb498c00cc86be9491564b5751c1d
MD5 c549246895fdf8d8725255427e2a7168
SHA1 ae7e4d99b82e6aba4366b34eba32b750d75a0234
SHA512 b6e8694d3e2bea07072dc643e6c2fe96defc2c8f2f7d9364e7cc1e8568039e340d81c541a8fbb91cd5e9b41b2b97716c0d22844cf179c16b53f96b7f64efc41a
SSDEEP 12288:B1alverQ2vhIc9fNS0JHz/WJUCUldYIwhW3ofgKzb:La
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

401030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

arnatic_7.exe

IMPHASH 621d175e940c3f2ca7217a398b3c22a6
SHA256 14cb2597414f705abc44a0c54322f995d4ac54b75b50daf64dc3b61895c9f6ea
MD5 fe5c49e95574a208cdcd0cbbd38d4e04
SHA1 c79e4a68e3499f66d6ed628911aed4868ce362ea
SHA512 cfbb2e8b3cf7fe2729ec3189ed18379251a8ed0b9803f3290bfe11be149331b79ec063eb4b506ee18b00d363c2b4b58b6c5d979ee8f03f9277735b5f5fab91a7
SSDEEP 6144:RgG2QIaoviJXS4tkOGhK85JOMnfJ/z1ZLdQKFKRsoVyhcdKriC:x2QfoviJC4t0K850MfJ/z1rQKFKNtdl
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\dijoha\zavur\luj88\bopuvo.pdb

kernel32

user32

GetMenuCheckMarkDimensions GetMenuInfo GetMenuBarInfo

null.exe

IMPHASH b3ec78e0ed5d1ea193492a20f9c8dca9
SHA256 91a7a0dd8930ad66fc44cac3720d7db83fda6f9902c967e47bec0d67cafc6631
MD5 f3a5853a448abbe8b10144d11401d835
SHA1 3b1faf00ff991c603fd6c9b01ba1f01e535bf5d4
SHA512 9c6b30a077859dfdc2e5d59d451096bc5089b3be8f44c7787cb4e82462789b50925964c2048ac7989699b47421622ed1d4c01507e56c87d7d5e83ef5253844cc
SSDEEP 12288:3kcf3zuGM5Zyc2YBXzziGlTA7W/+PzSYF6ey:3D3zuGMPA8TAvzuey
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5088

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\wasa.pdb

kernel32

GetComputerNameA EnumResourceNamesW SearchPathW CopyFileExW GetDriveTypeW SetEndOfFile GetNumberOfConsoleInputEvents FindResourceExW MapUserPhysicalPages LoadResource InterlockedIncrement ScrollConsoleScreenBufferW CreateDirectoryW GlobalLock WriteConsoleInputA GetCommProperties FreeEnvironmentStringsA SetTapeParameters GetModuleHandleW CreateNamedPipeW LocalFlags GetConsoleAliasesLengthA GetPrivateProfileStringW GetWindowsDirectoryA WriteFile SetCommState GetCommandLineA GetSystemWow64DirectoryA CreateDirectoryExW SetProcessPriorityBoost InitializeCriticalSection TlsSetValue GlobalAlloc LoadLibraryW GetCalendarInfoA ReadFileScatter SetSystemTimeAdjustment GetSystemWindowsDirectoryA TerminateProcess IsDBCSLeadByte GetBinaryTypeW GetOverlappedResult CompareStringW lstrlenW GetConsoleOutputCP VerifyVersionInfoW InterlockedExchange ReleaseActCtx GetFileSizeEx SetThreadLocale FindFirstFileA OpenMutexW GetCurrentDirectoryW GetProcAddress SetVolumeLabelW WriteProfileSectionA SetComputerNameA BuildCommDCBW GetLocalTime Process32FirstW OpenMutexA OpenWaitableTimerW SetConsoleCtrlHandler AddAtomA FindAtomA GetSystemInfo EnumResourceTypesW CreateIoCompletionPort SetConsoleTitleW FindNextFileW GetConsoleTitleW RequestWakeupLatency GetConsoleCursorInfo GetVersionExA InterlockedPushEntrySList GetProfileSectionW LCMapStringW AreFileApisANSI DeleteFileA GetVolumeInformationW GetModuleHandleA FlushFileBuffers GetStartupInfoA HeapValidate IsBadReadPtr RaiseException DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetModuleFileNameW SetUnhandledExceptionFilter QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime Sleep InterlockedDecrement ExitProcess GetModuleFileNameA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetLastError GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType TlsGetValue TlsAlloc TlsFree SetLastError HeapDestroy HeapCreate HeapFree VirtualFree HeapAlloc GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent HeapSize HeapReAlloc VirtualAlloc GetACP GetOEMCP GetCPInfo IsValidCodePage RtlUnwind InitializeCriticalSectionAndSpinCount DebugBreak OutputDebugStringA WriteConsoleW OutputDebugStringW LoadLibraryA MultiByteToWideChar LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA SetFilePointer GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA CreateFileA CloseHandle

user32

GetMenuInfo GetMessageTime GetMenuCheckMarkDimensions

ca0aef7482908df28ea75b42f8b26236aecfcc5b37421fdc0d309cee15500506

app.exe

PE Signature issue

kernel32

user32

generic

arnatic_2.exe

kernel32

user32

generic

arnatic_3.exe

kernel32

user32

ole32

generic

arnatic_4.exe

kernel32

advapi32

winhttp

generic

arnatic_5.exe

kernel32

user32

advapi32

generic

arnatic_6.exe

mscoree

dotnet

arnatic_7.exe

kernel32

user32

generic

null.exe

kernel32

user32

generic