socelars | f75d6ee676e63208489f05cd8c82d44fdda74b5752963e3967071f2d2d080113

Sharing

Copy URL Twitter E-mail

General

Target
f75d6ee676e63208489f05cd8c82d44fdda74b5752963e3967071f2d2d080113
Size 14.7MB
Sample241108-b33b7svmcm
SHA256 f75d6ee676e63208489f05cd8c82d44fdda74b5752963e3967071f2d2d080113
MD5 36e895cac68782276f49144d8904f79e
SHA1 411476265cdb80d2119ae49c34c6700a36577657
SHA512 db7e7997e7017fc083b067aa9a610be84e425a5a562829a02dd3650b0dcf42a4ced706a69d27b7e86ce503558b13f9791b107f4281b0f4845e1d83a874e24550
SSDEEP 393216:/OFW3CWhhMLh2BJcqpGZLvH023cP1vlhaR/nW67:/OFW3CWIIchL+2Rvf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

1.22 socelars redline sectoprat fabookie

Malware Config

Extracted

Family

socelars

http://www.iyiqian.com/
http://www.xxhufdc.top/
http://www.uefhkice.xyz/
http://www.fcektsy.top/

Extracted

Family

redline

Botnet

1.22

95.211.185.27:42097

Signatures

Detect Fabookie payload 1 IoCs

resource	yara_rule
static1/unpack002/vguuu.exe	family_fabookie

Fabookie family
fabookie

RedLine payload 1 IoCs

resource	yara_rule
static1/unpack002/redcloud.exe	family_redline

Redline family
redline

SectopRAT payload 1 IoCs

resource	yara_rule
static1/unpack002/redcloud.exe	family_sectoprat

Sectoprat family
sectoprat
Socelars family
socelars

Socelars payload 1 IoCs

resource	yara_rule
static1/unpack002/askinstall50.exe	family_socelars

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
static1/unpack002/jamesnew.exe	autoit_exe

Unsigned PE 16 IoCs

Checks for missing Authenticode signature.

resource
unpack002/DusBrowserInst.exe
unpack002/IDWCH2.exe
unpack002/Litever01.exe
unpack002/NAN.exe
unpack002/anyname.exe
unpack002/app.exe
unpack002/askinstall50.exe
unpack002/farlab_setup.exe
unpack002/inst002.exe
unpack002/jamesnew.exe
unpack002/justdezine.exe
unpack002/md3_3kvm.exe
unpack002/mixseven.exe
unpack002/redcloud.exe
unpack002/udptest.exe
unpack002/vguuu.exe

File Explorer

f75d6ee676e63208489f05cd8c82d44fdda74b5752963e3967071f2d2d080113

.zip 14.7MB
1038157f6d8e0bc282524fefbc0825825ea32d47b23072bae22534c6c9803e3d

.zip 14.8MB
6c5db6dce13ded4e0e6c7e9a526b063e.exe

.exe 4.3MB
DusBrowserInst.exe

.exe 172KB
IDWCH2.exe

.exe 739KB
Litever01.exe

.exe 502KB
NAN.exe

.exe 608KB
anyname.exe

.exe 100KB
app.exe

.exe 4.3MB
askinstall50.exe

.exe 1.4MB
farlab_setup.exe

.exe 1.7MB
inst002.exe

.exe 265KB
jamesnew.exe

.exe 846KB
justdezine.exe

.exe 136KB
md3_3kvm.exe

.exe 924KB
mixseven.exe

.exe 213KB
redcloud.exe

.exe 173KB
udptest.exe

.exe 240KB
vguuu.exe

.exe 1.3MB

f75d6ee676e63208489f05cd8c82d44fdda74b5752963e3967071f2d2d080113

SHA256 f75d6ee676e63208489f05cd8c82d44fdda74b5752963e3967071f2d2d080113
MD5 36e895cac68782276f49144d8904f79e
SHA1 411476265cdb80d2119ae49c34c6700a36577657
SHA512 db7e7997e7017fc083b067aa9a610be84e425a5a562829a02dd3650b0dcf42a4ced706a69d27b7e86ce503558b13f9791b107f4281b0f4845e1d83a874e24550
SSDEEP 393216:/OFW3CWhhMLh2BJcqpGZLvH023cP1vlhaR/nW67:/OFW3CWIIchL+2Rvf
MD5 SHA1 SHA512 SSDEEP

Password

infected

6c5db6dce13ded4e0e6c7e9a526b063e.exe

IMPHASH aa21a6d00a5d2896042e00aa2e960393
SHA256 036e1c48be2a9fde1e94334dcb1216eec8512b38c118234c118aaa47b6ad65c7
MD5 1485d115c0db789ed882e6da39b845d0
SHA1 b25ee4515f5a1a8b420e7eba38f233ee64a24755
SHA512 c8571df02ca3c8d69c49393d45a032a291c6f5c7100564e9a1337f287abd195c903bf86a20217990de38627d2a646dc7dde0e3953827afa94db270124c1f559b
SSDEEP 98304:xQ4LwEKgQe6M92LKCOdyzrXabdwkxMwasT9mrWhO:xQdej2GC+McdXxMTkO
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

67:f2:e3:34:34:b0:c0:28:44:f4:a4:43:df:ab:31:89:ba:c3:ed:29:7c:f0:a0:0b:26:9b:4f:48:38:3b:0a:71

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

POSTALCODE=10133

Chains

Nov 5, 2024

Minor OS version

Major OS version

Entry point

8733

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\yevitehupi\lelapari\xiwac31\xipiwegimibal dolu77\todivoruw.pdb

kernel32

lstrlenA GetCPInfo GetDefaultCommConfigW HeapAlloc _lwrite InterlockedDecrement GetCurrentProcess GetSystemWindowsDirectoryW GetUserDefaultLCID SetVolumeMountPointW GetCommandLineA GetEnvironmentStrings GlobalAlloc ReadConsoleInputA WriteConsoleOutputA GetVersionExW GetComputerNameExA lstrcpynW LocalReAlloc HeapQueryInformation ReadFile VerifyVersionInfoW GetCPInfoExW ChangeTimerQueueTimer GetProcAddress AttachConsole PeekConsoleInputW VerLanguageNameA FreeUserPhysicalPages GetLocalTime LoadLibraryA BeginUpdateResourceA GetCurrentConsoleFont SetEnvironmentVariableA GetConsoleTitleW BuildCommDCBA VirtualProtect FindFirstVolumeA ReleaseMutex GetVersion AddConsoleAliasA EnumCalendarInfoExA LCMapStringW CreateThread CreateFileA SetStdHandle CreateTimerQueue GetModuleFileNameW GetSystemDefaultLangID WriteConsoleW GetConsoleOutputCP WideCharToMultiByte InterlockedIncrement InterlockedExchange MultiByteToWideChar Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter GetLastError HeapFree TerminateProcess IsDebuggerPresent GetModuleHandleW ExitProcess GetStartupInfoA RtlUnwind RaiseException LCMapStringA GetStringTypeW WriteFile GetStdHandle GetModuleFileNameA HeapCreate VirtualFree VirtualAlloc HeapReAlloc TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetStringTypeA HeapSize GetACP GetOEMCP IsValidCodePage GetLocaleInfoA GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer CloseHandle WriteConsoleA

user32

RealGetWindowClassA GetCaretPos

DusBrowserInst.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 1db05647c15a26167a50bf7cf1d5f2d00ae89e4f18cfba2bcb4024f043c81739
MD5 2bf65413a6aabdbb7f18b7efebee633d
SHA1 c4eed75b2d69ca51ce87ede0a907db0ecbb4f4b7
SHA512 b59fcc75925273239c90520d616a9e5dddacfc36d6cefb1f464dab3ef066aebfc57adfd9e28484aadfb9ed6a9dde4d509e0eee2bc5245a795025c64fb790fb2f
SSDEEP 3072:OqJYORWz8q9slhk6/admfp4dipoaDNzuYnr+YvRRB:Kb9Hdmf9P
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

204810

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

IDWCH2.exe

SHA256 b64cc3011b334fe3fdc47852da28f1d865a1f71dd819827a035b9b3adab1a163
MD5 0d5cc91890c411599e994ab4d927350b
SHA1 b64c4752537fc05bd460918fe252ef64e72d2651
SHA512 56418a6586f0cc7f985e944811744fdce2ddaea5e238d02b21435768a3738ba7cccc738190b677f0eb66916a24cdcd4b63701df8a35c7a44802ba053ccdf059b
SSDEEP 6144:d/QiQXC45m+ksmpk3U9j0IeP2soxvjFEOTb9WmZX/8shzdsY4CpHPhnq/FK:VQi34c6m6UR0IeP2p1hf39Wkv8xwJqdK
MD5 SHA1 SHA512 SSDEEP

windows:1 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

42488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

1024B

Virtual Size

592B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

368KB

Virtual Size

367KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Litever01.exe

IMPHASH aa21a6d00a5d2896042e00aa2e960393
SHA256 659895bb642f43854043053d386b987c63db7e615d827dbc41866ac0371ab92d
MD5 bca995c0fd475fb09fb7988cb876c795
SHA1 0f8776b9a5b3daedcc314fa283172697dee4cf8d
SHA512 94387589151f5dc774aaf981988c8f6b568e8373158ce79b5da370594a6f67f18c5b90547da62db70a808a9756fc318eeb3cd6df9b87495bfde379a46e2699df
SSDEEP 12288:+Ircrb5sQow2/ZswWmTV9LSuxlrwvAsP4BmHc:+mQb5gnZswWmTbLnxyvpP6
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8733

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\puropar-focikaga\jeyedekaje.pdb

kernel32

user32

RealGetWindowClassA GetCaretPos

NAN.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 578eddcbe98744e25e8836b7cdc447f62b7032bcd3d083f2eb0cfe018022243e
MD5 db1e5d0455f39c5cf5ac0c210dd679c4
SHA1 836e95bd1285ff790e55a8602febb29d97187bd7
SHA512 3f349ba618510f3e76e893fb70f0bfd5c3885216d73ed024617b49878eed376789eb7d3e4d347bb84aec8d90dbd0706256cdfdfa3f99c3b2b62982d9bc5c3a25
SSDEEP 12288:hjMQXZURC7TnfAWtUu/wQfmY4IG6zsJMWHn4oFl8n/bmThV:hjB34FC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

626894

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

anyname.exe

IMPHASH c6135ffdfa8b888ab780237cbe8d7634
SHA256 f67d7d488b447f8a6356bff9d49add653ef5c49e6dc74982005028d01609c24a
MD5 2cd68cb7fd85144362d03a0b260f338f
SHA1 6e106cc5246ed9fe053ef748b28022183e520ad9
SHA512 4ac9508d59f9f32d5b883b78b2b4cc80a7364731d96f01f53d816055fe7e1f8505790796ca4696c6810de89331a346e2b5eedd071c50b56c10489bcc9b72693c
SSDEEP 3072:AH5/hX4B1I+Fe7UovWk07XFBbyzqRyZ/4Ji/:m/JK1RkZGXw/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14398

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WriteFile InterlockedDecrement InitializeCriticalSectionAndSpinCount CreateFileW GetLastError lstrcatW CloseHandle RaiseException DecodePointer DeleteCriticalSection WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers HeapReAlloc HeapSize GetStringTypeW SetStdHandle GetFileType GetProcessHeap SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP IsValidCodePage UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW EnterCriticalSection LeaveCriticalSection MultiByteToWideChar WideCharToMultiByte LocalFree EncodePointer RtlUnwind SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameA GetStdHandle GetCommandLineA GetCommandLineW GetACP HeapFree HeapAlloc CompareStringW LCMapStringW FindClose FindFirstFileExA FindNextFileA

ole32

CoUninitialize CoSetProxyBlanket CoInitializeSecurity CoCreateInstance CoInitialize

oleaut32

SafeArrayGetDim VariantInit SafeArrayGetUBound SafeArrayGetLBound SysFreeString SysStringByteLen SysAllocStringByteLen SysAllocString VariantCopy SysStringLen SafeArrayUnaccessData SysAllocStringLen SafeArrayAccessData VariantClear GetErrorInfo

app.exe

IMPHASH aa21a6d00a5d2896042e00aa2e960393
SHA256 a5d0a8eb93516f6979ce8da08a5750bf7f0f0fc98a969cd9e5b175dd29302a86
MD5 d3f680a40104a2bf44d1e55ab22cc283
SHA1 3e44293bd666ee6842f27001e561442203479698
SHA512 478c308a40b3da9697ef9925e3d8c375bdc9a51d17d401fdf947f1e9ec7b4b5b59d5aa6e5ab0857825f5dbcb398a1cfffe33f972b6841d2916329f2e2358510b
SSDEEP 98304:MQ4LwEKgQe6M92LKCOdyzrXabdwkxMwasT9mrWh:MQdej2GC+McdXxMTk
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8733

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\yevitehupi\lelapari\xiwac31\xipiwegimibal dolu77\todivoruw.pdb

kernel32

user32

RealGetWindowClassA GetCaretPos

askinstall50.exe

IMPHASH 4f0608b5638c60342069764638589dcf
SHA256 fd53ca7be25f932d930f68ab7818359762dde5d3608271e7a27e815f5b30e9e4
MD5 68bc0c244bb2d261a9a7d007bb6e06d7
SHA1 4226d51ebf9d925de953e0a5a6b3784eabfc47b6
SHA512 f52a04cd2a5d0f9f30be1b6827e95f5afe5f34d0453a78b000dd71d7d8e20467ef6f541a91858833704df6b1560cb5701eab08e5df0a86870b946b052cd6d9da
SSDEEP 24576:8IVFA1pqtg/TnMbX0lwyh0FVmEByA1EwFYyOsFTceoCSPZVjQtYfeXPPSTy:NFA1pvTMbOwa0TmUyMYEh1oCSPnQtY2/
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Socelars payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

882076

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\facebook_svn\trunk\database\Release\DiskScan.pdb

kernel32

LocalAlloc LocalFree WinExec GetComputerNameW GetModuleFileNameA GetCurrentProcessId OpenProcess GetModuleFileNameW SetLastError GetCurrentThread FindResourceW GetPrivateProfileStringW CopyFileW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP SizeofResource CreateProcessA LockResource LoadResource FreeLibrary GetTickCount TerminateProcess Sleep WaitForSingleObject GetProcessHeap HeapAlloc GetLastError GetTempPathA CreateDirectoryA SetCurrentDirectoryW GetShortPathNameA LoadLibraryW GetProcAddress WideCharToMultiByte MultiByteToWideChar SystemTimeToFileTime DosDateTimeToFileTime GetCurrentProcess DuplicateHandle CloseHandle WriteFile SetFileTime SetFilePointer ReadFile GetFileType CreateFileW CreateDirectoryW CreateEventW GetCurrentDirectoryW GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation GetFileSizeEx GetConsoleCP SetFilePointerEx ReadConsoleW GetConsoleMode EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetCommandLineW GetCommandLineA GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW RtlUnwind RaiseException GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW GetCPInfo TlsFree WriteConsoleW TlsSetValue TlsGetValue TlsAlloc SwitchToThread DecodePointer EncodePointer InitializeSListHead GetStartupInfoW IsDebuggerPresent GetModuleHandleW ResetEvent SetEvent InitializeCriticalSectionAndSpinCount IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter FlushFileBuffers QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime AreFileApisANSI TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW GetFileAttributesW GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize FormatMessageW GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc GetSystemInfo HeapCompact HeapDestroy UnlockFile LockFileEx GetFileSize DeleteCriticalSection

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges LookupAccountNameW SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl IsValidSecurityDescriptor InitializeSecurityDescriptor InitializeAcl GetTokenInformation GetLengthSid FreeSid EqualSid DuplicateToken AllocateAndInitializeSid AddAccessAllowedAce AccessCheck OpenThreadToken OpenProcessToken

shell32

ShellExecuteExA

ole32

CoInitializeEx CoGetObject CoUninitialize

wininet

InternetGetCookieExA

netapi32

Netbios

ntdll

RtlInitUnicodeString NtFreeVirtualMemory LdrEnumerateLoadedModules RtlEqualUnicodeString RtlAcquirePebLock NtAllocateVirtualMemory RtlReleasePebLock RtlNtStatusToDosError RtlCreateHeap RtlDestroyHeap RtlAllocateHeap RtlFreeHeap NtClose NtOpenKey NtEnumerateValueKey NtQueryValueKey

Name

.text

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.hgrgefx

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.hgrgefx

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.hgrgefx

Size

1024B

Virtual Size

707B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.hgrgefx

Size

1024B

Virtual Size

598B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.hgrgefx

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.hgrgefx

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.hgrgefx

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

186KB

Virtual Size

186KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.hgrgefx

Size

512B

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

118KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

farlab_setup.exe

SHA256 6a17ebf5da6aa3a1f4813e5f46fdd5d19d026bcfac91f232359f98e43df3c38f
MD5 a7703240793e447ec11f535e808d2096
SHA1 913af985f540dab68be0cdf999f6d7cb52d5be96
SHA512 57bdcdfcfa11f6b5bf4149be0fee0444fcf67ccececf1009b166b17b7dce30da1a472f1890736186f4ef76e02ed23cc0dd2a41dc9bff94218a059832d4b5c69e
SSDEEP 49152:C9CKxz5eM8JvooqXrFzYA8hVU2AGm63yjpGIcLJjmyGpf8:MCm5eMOooqhomhjrcLS8
MD5 SHA1 SHA512 SSDEEP

windows:1 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

42488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

1024B

Virtual Size

592B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

inst002.exe

IMPHASH b900dc5ab09e702140c5c289f35fb91f
SHA256 94590b6681e3f9255a27b41a356d0334460ed596daab947258110a4ab94708db
MD5 f38f3aab5af6435226dcca8751f61e6c
SHA1 e555e536dca72784f73422a216aa35206441444a
SHA512 0402a9d77388348aa055ab58a3211222ffdbe043e73052e075d861d1d0888437cfdeb2c2d7676b23e539b573bd4a4180d4e5f8af840693823979997f99c76c09
SSDEEP 3072:7DO+LxoC9PZUFfYS3azG0CYUZTCldBG//7VxSVzsC1X6R8geXrVpAFdcmuYT:7a0Sf7oQYUdgiizn9XrXeddTT
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19988

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

comctl32

ord6 ord17

kernel32

GetCommandLineW OutputDebugStringW RtlUnwind WriteConsoleW HeapReAlloc SetFilePointerEx LCMapStringW GetStringTypeW FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime GetModuleHandleA QueryPerformanceCounter CloseHandle CreateFileW LoadLibraryExW GetProcessHeap GetModuleHandleW TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess GetCurrentProcess InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter GetStartupInfoW LoadLibraryA GetStdHandle LocalFree LocalAlloc GetProcAddress GetModuleFileNameW GetModuleFileNameA GetFileType GetLastError Sleep GetCurrentProcessId GlobalUnlock GlobalLock GlobalAlloc GetConsoleCP WriteFile FlushFileBuffers DeleteCriticalSection IsProcessorFeaturePresent HeapSize IsDebuggerPresent EnterCriticalSection LeaveCriticalSection SetStdHandle HeapAlloc EncodePointer DecodePointer ExitProcess GetModuleHandleExW MultiByteToWideChar WideCharToMultiByte HeapFree GetConsoleMode ReadConsoleInputA SetConsoleMode GetCommandLineA IsValidCodePage GetACP GetOEMCP GetCPInfo SetLastError GetCurrentThreadId

user32

TranslateAcceleratorA GetMessageA TranslateMessage DispatchMessageA SendMessageA WaitForInputIdle InflateRect GetSysColorBrush SetCursor SetWindowTextA EndDialog DialogBoxIndirectParamA LoadIconA LoadCursorA FindWindowExA FindWindowA MessageBoxA GetClientRect SetForegroundWindow DefWindowProcA UpdateWindow LoadAcceleratorsA EnableWindow SetFocus EmptyClipboard SetClipboardData CloseClipboard OpenClipboard GetDlgItem EndDeferWindowPos DeferWindowPos BeginDeferWindowPos MoveWindow ShowWindow CreateWindowExA RegisterClassExA PostQuitMessage

gdi32

StartPage EndDoc StartDocA SetMapMode GetStockObject GetDeviceCaps DeleteDC CreateDCA EndPage

comdlg32

PrintDlgA

advapi32

RegQueryValueExA RegEnumKeyA RegOpenKeyExA RegSetValueExA RegQueryValueExW RegOpenKeyA RegCreateKeyA RegCloseKey

shell32

ShellExecuteExA

jamesnew.exe

IMPHASH eb97e4fc5518ac300a92a11673825e0b
SHA256 8a75fd219504039ceb7841811d75416ca52eb26a9667bbdf621055dad62e8b1a
MD5 ea180cb17e71d8e32481aa37cb796cc1
SHA1 351b1c6cdbdcd21215e6cb9fc7b76887ddfe7a2a
SHA512 7bfe33816e5d6373cdbae1b8fffb620e76defabd1302b8c98650980ac0292b3135cee52d7316b8fe895812e56b2a7cfa2aa983d7e746f4673c37f1b585636cbc
SSDEEP 24576:1AHnh+eWsN3skA4RV1Hom2KXMmHaR1K5:kh+ZkldoPK8YaRi
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

163850

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

wsock32

WSACleanup socket inet_ntoa setsockopt ntohs recvfrom ioctlsocket htons WSAStartup __WSAFDIsSet select accept listen bind closesocket WSAGetLastError recv sendto send inet_addr gethostbyname gethostname connect

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

winmm

timeGetTime waveOutSetVolume mciSendStringW

comctl32

ImageList_ReplaceIcon ImageList_Destroy ImageList_Remove ImageList_SetDragCursorImage ImageList_BeginDrag ImageList_DragEnter ImageList_DragLeave ImageList_EndDrag ImageList_DragMove InitCommonControlsEx ImageList_Create

mpr

WNetUseConnectionW WNetCancelConnection2W WNetGetConnectionW WNetAddConnection2W

wininet

InternetQueryDataAvailable InternetCloseHandle InternetOpenW InternetSetOptionW InternetCrackUrlW HttpQueryInfoW InternetQueryOptionW HttpOpenRequestW HttpSendRequestW FtpOpenFileW FtpGetFileSize InternetOpenUrlW InternetReadFile InternetConnectW

psapi

GetProcessMemoryInfo

iphlpapi

IcmpCreateFile IcmpCloseHandle IcmpSendEcho

userenv

DestroyEnvironmentBlock UnloadUserProfile CreateEnvironmentBlock LoadUserProfileW

uxtheme

IsThemeActive

kernel32

DuplicateHandle CreateThread WaitForSingleObject HeapAlloc GetProcessHeap HeapFree Sleep GetCurrentThreadId MultiByteToWideChar MulDiv GetVersionExW IsWow64Process GetSystemInfo FreeLibrary LoadLibraryA GetProcAddress SetErrorMode GetModuleFileNameW WideCharToMultiByte lstrcpyW lstrlenW GetModuleHandleW QueryPerformanceCounter VirtualFreeEx OpenProcess VirtualAllocEx WriteProcessMemory ReadProcessMemory CreateFileW SetFilePointerEx SetEndOfFile ReadFile WriteFile FlushFileBuffers TerminateProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW SetFileTime GetFileAttributesW FindFirstFileW SetCurrentDirectoryW GetLongPathNameW GetShortPathNameW DeleteFileW FindNextFileW CopyFileExW MoveFileW CreateDirectoryW RemoveDirectoryW SetSystemPowerState QueryPerformanceFrequency FindResourceW LoadResource LockResource SizeofResource EnumResourceNamesW OutputDebugStringW GetTempPathW GetTempFileNameW DeviceIoControl GetLocalTime CompareStringW GetCurrentProcess EnterCriticalSection LeaveCriticalSection GetStdHandle CreatePipe InterlockedExchange TerminateThread LoadLibraryExW FindResourceExW CopyFileW VirtualFree FormatMessageW GetExitCodeProcess GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileSectionW WritePrivateProfileSectionW GetPrivateProfileSectionNamesW FileTimeToLocalFileTime FileTimeToSystemTime SystemTimeToFileTime LocalFileTimeToFileTime GetDriveTypeW GetDiskFreeSpaceExW GetDiskFreeSpaceW GetVolumeInformationW SetVolumeLabelW CreateHardLinkW SetFileAttributesW CreateEventW SetEvent GetEnvironmentVariableW SetEnvironmentVariableW GlobalLock GlobalUnlock GlobalAlloc GetFileSize GlobalFree GlobalMemoryStatusEx Beep GetSystemDirectoryW HeapReAlloc HeapSize GetComputerNameW GetWindowsDirectoryW GetCurrentProcessId GetProcessIoCounters CreateProcessW GetProcessId SetPriorityClass LoadLibraryW VirtualAlloc IsDebuggerPresent GetCurrentDirectoryW lstrcmpiW DecodePointer GetLastError RaiseException InitializeCriticalSectionAndSpinCount DeleteCriticalSection InterlockedDecrement InterlockedIncrement GetCurrentThread CloseHandle GetFullPathNameW EncodePointer ExitProcess GetModuleHandleExW ExitThread GetSystemTimeAsFileTime ResumeThread GetCommandLineW IsProcessorFeaturePresent IsValidCodePage GetACP GetOEMCP GetCPInfo SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetStringTypeW SetStdHandle GetFileType GetConsoleCP GetConsoleMode RtlUnwind ReadConsoleW GetTimeZoneInformation GetDateFormatW GetTimeFormatW LCMapStringW GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW FindClose SetEnvironmentVariableA

user32

AdjustWindowRectEx CopyImage SetWindowPos GetCursorInfo RegisterHotKey ClientToScreen GetKeyboardLayoutNameW IsCharAlphaW IsCharAlphaNumericW IsCharLowerW IsCharUpperW GetMenuStringW GetSubMenu GetCaretPos IsZoomed MonitorFromPoint GetMonitorInfoW SetWindowLongW SetLayeredWindowAttributes FlashWindow GetClassLongW TranslateAcceleratorW IsDialogMessageW GetSysColor InflateRect DrawFocusRect DrawTextW FrameRect DrawFrameControl FillRect PtInRect DestroyAcceleratorTable CreateAcceleratorTableW SetCursor GetWindowDC GetSystemMetrics GetActiveWindow CharNextW wsprintfW RedrawWindow DrawMenuBar DestroyMenu SetMenu GetWindowTextLengthW CreateMenu IsDlgButtonChecked DefDlgProcW CallWindowProcW ReleaseCapture SetCapture CreateIconFromResourceEx mouse_event ExitWindowsEx SetActiveWindow FindWindowExW EnumThreadWindows SetMenuDefaultItem InsertMenuItemW IsMenu TrackPopupMenuEx GetCursorPos DeleteMenu SetRect GetMenuItemID GetMenuItemCount SetMenuItemInfoW GetMenuItemInfoW SetForegroundWindow IsIconic FindWindowW MonitorFromRect keybd_event SendInput GetAsyncKeyState SetKeyboardState GetKeyboardState GetKeyState VkKeyScanW LoadStringW DialogBoxParamW MessageBeep EndDialog SendDlgItemMessageW GetDlgItem SetWindowTextW CopyRect ReleaseDC GetDC EndPaint BeginPaint GetClientRect GetMenu DestroyWindow EnumWindows GetDesktopWindow IsWindow IsWindowEnabled IsWindowVisible EnableWindow InvalidateRect GetWindowLongW GetWindowThreadProcessId AttachThreadInput GetFocus GetWindowTextW ScreenToClient SendMessageTimeoutW EnumChildWindows CharUpperBuffW GetParent GetDlgCtrlID SendMessageW MapVirtualKeyW PostMessageW GetWindowRect SetUserObjectSecurity CloseDesktop CloseWindowStation OpenDesktopW SetProcessWindowStation GetProcessWindowStation OpenWindowStationW GetUserObjectSecurity MessageBoxW DefWindowProcW SetClipboardData EmptyClipboard CountClipboardFormats CloseClipboard GetClipboardData IsClipboardFormatAvailable OpenClipboard BlockInput GetMessageW LockWindowUpdate DispatchMessageW TranslateMessage PeekMessageW UnregisterHotKey CheckMenuRadioItem CharLowerBuffW MoveWindow SetFocus PostQuitMessage KillTimer CreatePopupMenu RegisterWindowMessageW SetTimer ShowWindow CreateWindowExW RegisterClassExW LoadIconW LoadCursorW GetSysColorBrush GetForegroundWindow MessageBoxA DestroyIcon SystemParametersInfoW LoadImageW GetClassNameW

gdi32

StrokePath DeleteObject GetTextExtentPoint32W ExtCreatePen GetDeviceCaps EndPath SetPixel CloseFigure CreateCompatibleBitmap CreateCompatibleDC SelectObject StretchBlt GetDIBits LineTo AngleArc MoveToEx Ellipse DeleteDC GetPixel CreateDCW GetStockObject GetTextFaceW CreateFontW SetTextColor PolyDraw BeginPath Rectangle SetViewportOrgEx GetObjectW SetBkMode RoundRect SetBkColor CreatePen CreateSolidBrush StrokeAndFillPath

comdlg32

GetOpenFileNameW GetSaveFileNameW

advapi32

GetAce RegEnumValueW RegDeleteValueW RegDeleteKeyW RegEnumKeyExW RegSetValueExW RegOpenKeyExW RegCloseKey RegQueryValueExW RegConnectRegistryW InitializeSecurityDescriptor InitializeAcl AdjustTokenPrivileges OpenThreadToken OpenProcessToken LookupPrivilegeValueW DuplicateTokenEx CreateProcessAsUserW CreateProcessWithLogonW GetLengthSid CopySid LogonUserW AllocateAndInitializeSid CheckTokenMembership RegCreateKeyExW FreeSid GetTokenInformation GetSecurityDescriptorDacl GetAclInformation AddAce SetSecurityDescriptorDacl GetUserNameW InitiateSystemShutdownExW

shell32

DragQueryPoint ShellExecuteExW DragQueryFileW SHEmptyRecycleBinW SHGetPathFromIDListW SHBrowseForFolderW SHCreateShellItem SHGetDesktopFolder SHGetSpecialFolderLocation SHGetFolderPathW SHFileOperationW ExtractIconExW Shell_NotifyIconW ShellExecuteW DragFinish

ole32

CoTaskMemAlloc CoTaskMemFree CLSIDFromString ProgIDFromCLSID CLSIDFromProgID OleSetMenuDescriptor MkParseDisplayName OleSetContainedObject CoCreateInstance IIDFromString StringFromGUID2 CreateStreamOnHGlobal OleInitialize OleUninitialize CoInitialize CoUninitialize GetRunningObjectTable CoGetInstanceFromFile CoGetObject CoSetProxyBlanket CoCreateInstanceEx CoInitializeSecurity

oleaut32

LoadTypeLibEx VariantCopyInd SysReAllocString SysFreeString SafeArrayDestroyDescriptor SafeArrayDestroyData SafeArrayUnaccessData SafeArrayAccessData SafeArrayAllocData SafeArrayAllocDescriptorEx SafeArrayCreateVector RegisterTypeLi CreateStdDispatch DispCallFunc VariantChangeType SysStringLen VariantTimeToSystemTime VarR8FromDec SafeArrayGetVartype VariantCopy VariantClear OleLoadPicture QueryPathOfRegTypeLi RegisterTypeLibForUser UnRegisterTypeLibForUser UnRegisterTypeLi CreateDispTypeInfo SysAllocString VariantInit

justdezine.exe

IMPHASH aa21a6d00a5d2896042e00aa2e960393
SHA256 6d5ac5464acd393224513115ebee2eeca5efca62b2a0e92f50c5186a8f740581
MD5 7bd33952ce41285449099ae0bcd48d81
SHA1 1d6224283dd85c51a22445a69b1f2771724a7733
SHA512 bbe8a7d76db63b498b0ff8736ab010c12506b8f27b17eaeb13a77d0972e6512a54dccbf5c050642ffe7665647439c5fd1424312677b351d7fe893a7956728c05
SSDEEP 1536:w8Voh/WygQ/HlLg7ppfmFuOJFrh3dPiifz6JCzUKuhOZa0atsjk5/Npj6T61mD:wNqzo1lNqirxuhOZ7+sI5/DuT61m
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8733

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\kacipimala55\zevejumife haj\mevowegezazu99\rafi.pdb

kernel32

user32

RealGetWindowClassA GetCaretPos

md3_3kvm.exe

IMPHASH 09d0478591d4f788cb3e5ea416c25237
SHA256 de95d03777407422fac23d6c1f0740e131a0d38c5ef19aca742c7bcf1a994fd7
MD5 53b01ccd65893036e6e73376605da1e2
SHA1 12c7162ea3ce90ec064ce61251897c8bec3fd115
SHA512 e5d1dd0ac1a53df261179d58817e71f4b263179ba1f1599da3b654ae9550dc608afc5a12057fb533aab0abb2eb406e3a7331e10a6f2b91254f062a777299e067
SSDEEP 24576:pP7A681d48vGlldFtqFbDNaYaPCQFXVDXE4IfmDWQ:pzF8I8vGbdFtabDNUPCQFXVDXvdDWQ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

637974

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

mixseven.exe

IMPHASH aa21a6d00a5d2896042e00aa2e960393
SHA256 438676e5d2d9fd41a35b18eee5db8917e7f960f0d50917513f4fb92b95d29995
MD5 984f9ec5ff106e4c08bb076ef63f3ec2
SHA1 119152d00b0b883cefae6519bbe4be43c6e1aafd
SHA512 641cdf64b6ba39fb01c0bbe86aa878026e9f61280a83d449d67656dfa89100957f9e5b2b575b7ec460a0eeb4d2a8ef8da0781de58d3c518be2a2ae97ce1acd6a
SSDEEP 3072:qYq47wlx3K0mbLClhjJPHH93Bf8Pwv+/FvFeWB3SaPkN1hL8csI5/DuT61m:qf4uxaKl5JPHH96vFeWVk5LsI5/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8733

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vutucuze_wuwijegi44\naj.pdb

kernel32

user32

RealGetWindowClassA GetCaretPos

redcloud.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 6038860aefedc84fdafe7d693ea6fa63147be5e3a43dd96e20adf377811c5d30
MD5 16bf4653dfc06b85e7d34cb5cfe62717
SHA1 35ca16cdb661f6978815efc8c8a2ae0fbddcb733
SHA512 0717f23056515b18f627496c309c22bfc76da5b61f2730a320fa8584ad0fb5ed47a8695ad255bc8635cdd379d2313cb141466e86ae0b639c33772fe2177fa35f
SSDEEP 1536:8t9pmEJnCKOAD3dOlbi2JKnJbpNjbuqGd0AMuyq+d0+7dDjElG6qTaoigQwY8ls:CTnCK1DtCbi2AHhG0Ajyjd0iY428ls
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

RedLine payload
SectopRAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

108346

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

udptest.exe

IMPHASH aa21a6d00a5d2896042e00aa2e960393
SHA256 e102abb40eb0795f838749e262c4e94af6df4213832b1d055b727cbc50f3a8ee
MD5 265717bdcb626127fdb7e62b018e963c
SHA1 d9d70e33380e33caa8c48b6a4ba7a4fe08ecafe5
SHA512 f9c3656bb1e9848620990ca2ee8c163f32c2259774cf21ff78979ba1318daabb672ba1a67924b90d55cce8b579830bf31db32e2da83a09b51916c60ca157f362
SSDEEP 3072:z+9IWjNSUNngwphQyI+wyym+l2Dnn3e+3kC5p67Bp+QcsC/ddhrPOv/SsI5/DuTR:zBUNngwp8Kn3e+0C5pyBp+xsQNbsI5/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8733

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vexozenocoh\doh\rax.pdb

kernel32

user32

RealGetWindowClassA GetCaretPos

vguuu.exe

IMPHASH 0e0b1327b851d652046461e0a8be7593
SHA256 4759a108a1a33d66992db0371dd760ef6edb0a6a773ccf4263e0efeb2c76a80e
MD5 652050d5745a5303a8ff54662e77902c
SHA1 740d12548b306b4ed1953ecdbf90fa7255b2fda7
SHA512 6913129d8faad2c97cff339e9206eab990a7c31ec70d3c77169f51113fed52e612c696d40a3209e248bfe6eafa3f1b998ac654675810fed1f671308023e267e2
SSDEEP 24576:HAFnWzNUe3a9nvOvk+/QBNFjmDWTe2c6Ek:yWzmeK9n2FQbFBTq4
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Detect Fabookie payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

733304

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\workspace\workspace_c\shellcode_ms\SCY7VJ5UA3Du3GAh1_jm1\x64\Release\SCY7VJ5UA3Du3GAh1_jm1.pdb

kernel32

AreFileApisANSI ReadFile TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW WriteFile GetDiskFreeSpaceW LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW WaitForSingleObject CreateFileW GetFileAttributesW GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize MultiByteToWideChar GetTempPathA GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW CreateFileA LoadLibraryA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc CloseHandle GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress CreateFileMappingA LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId GetProcessHeap SystemTimeToFileTime FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers LocalFree GetLastError FormatMessageW lstrlenW FindResourceW LoadResource LockResource SizeofResource GetStringTypeW EncodePointer DecodePointer GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetEvent ResetEvent InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess QueryPerformanceFrequency GetCurrentThread GetThreadTimes RtlUnwindEx InterlockedPushEntrySList RtlPcToFileHeader RaiseException LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW GetStdHandle IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetTimeZoneInformation GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadConsoleW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW Sleep OutputDebugStringA RtlUnwind

advapi32

RegOpenKeyExW RegSetValueExW RegCreateKeyW RegCloseKey

shell32

SHGetFolderPathW

winhttp

WinHttpQueryDataAvailable WinHttpConnect WinHttpReceiveResponse WinHttpOpen WinHttpAddRequestHeaders WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpGetIEProxyConfigForCurrentUser WinHttpQueryAuthSchemes WinHttpGetProxyForUrl WinHttpSendRequest WinHttpSetCredentials

crypt32

CryptUnprotectData

Name

.text

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

248KB

Virtual Size

248KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

24KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

568B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Extracted

Signatures

File Explorer

f75d6ee676e63208489f05cd8c82d44fdda74b5752963e3967071f2d2d080113

1038157f6d8e0bc282524fefbc0825825ea32d47b23072bae22534c6c9803e3d

6c5db6dce13ded4e0e6c7e9a526b063e.exe

PE Signature issue

kernel32

user32

generic

DusBrowserInst.exe

mscoree

dotnet

IDWCH2.exe

generic

Litever01.exe

kernel32

user32

generic

NAN.exe

mscoree

dotnet

anyname.exe

kernel32

ole32

oleaut32

generic

app.exe

kernel32

user32

generic

askinstall50.exe

kernel32

advapi32

shell32

ole32

wininet

netapi32

ntdll

generic

farlab_setup.exe

generic

inst002.exe

comctl32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

generic

jamesnew.exe

wsock32

version

winmm

comctl32

mpr

wininet

psapi

iphlpapi

userenv

uxtheme

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

generic

justdezine.exe

kernel32

user32

generic

md3_3kvm.exe