FadeSEC[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
FadeSEC.exe
Size 350KB
Sample260720-q4bcfab15l
SHA256 bdb8a2b5ffc4025cd16b91854a1b78cc714e1750e1b51bf024d7ee44ec2d0a25
MD5 fadf6eec4a2abd999605282526a5cee1
SHA1 3040c951fc4ef8ff2ec7c0704b3ad8d8f6a64fc0
SHA512 b71f86bd73a7c86b5df68aa730aa0364d991b3a001f6f36fdcb06e3fd3264a987fcb3c0bb2a5ec11ca35f7f972055ac15f5319fb684ce0cbfdfe02cee8096804
SSDEEP 6144:eqVaJI7RZKnhz6hwF3ZhBasFr72CbmVw/mYnk7S:vR8sSXhxFr7Lm2/mYn
TLSH
T184748D16F7A514F9E1A7C178CD524906DBB27C4A07A1ABCF23A04A961F237E09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FadeSEC.exe

File Explorer

FadeSEC.exe

.exe 350KB

FadeSEC.exe

IMPHASH 6e26b2517ec5c8f498d06b2d67e684ca
SHA256 bdb8a2b5ffc4025cd16b91854a1b78cc714e1750e1b51bf024d7ee44ec2d0a25
MD5 fadf6eec4a2abd999605282526a5cee1
SHA1 3040c951fc4ef8ff2ec7c0704b3ad8d8f6a64fc0
SHA512 b71f86bd73a7c86b5df68aa730aa0364d991b3a001f6f36fdcb06e3fd3264a987fcb3c0bb2a5ec11ca35f7f972055ac15f5319fb684ce0cbfdfe02cee8096804
SSDEEP 6144:eqVaJI7RZKnhz6hwF3ZhBasFr72CbmVw/mYnk7S:vR8sSXhxFr7Lm2/mYn
TLSH
T184748D16F7A514F9E1A7C178CD524906DBB27C4A07A1ABCF23A04A961F237E09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

96244

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptSetProperty BCryptGenRandom BCryptDestroyKey BCryptDecrypt BCryptEncrypt BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider

user32

GetMessageA LoadCursorA CallNextHookEx UnhookWindowsHookEx SetWindowsHookExA FindWindowA FillRect GetClientRect InvalidateRect EndPaint BeginPaint SetForegroundWindow GetSystemMetrics SetTimer GetAsyncKeyState SetWindowPos ShowWindow CreateWindowExA RegisterClassA PostQuitMessage DefWindowProcA PostMessageA DispatchMessageA TranslateMessage

gdi32

TextOutA MoveToEx SetTextColor SetBkMode SelectObject SelectClipRgn Rectangle LineTo IntersectClipRect GetStockObject DeleteObject CreateSolidBrush CreatePen CreateFontA

advapi32

RegOpenKeyExA RegCloseKey RegSetValueExA

kernel32

SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType ReadConsoleW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW HeapReAlloc IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap HeapSize SetStdHandle WriteConsoleW SetEndOfFile EnumSystemLocalesW LeaveCriticalSection GetDriveTypeA GetCurrentProcess CreateThread SetPriorityClass GetLogicalDriveStringsA LocalFree FormatMessageA GetLocaleInfoEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId WideCharToMultiByte CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI CloseHandle GetLastError GetModuleHandleW GetProcAddress MoveFileExW GetFileInformationByHandleEx MultiByteToWideChar EnterCriticalSection RtlUnwind InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceCounter EncodePointer DecodePointer LCMapStringEx GetSystemTimeAsFileTime GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess GetCurrentProcessId InitializeSListHead VirtualProtect RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree

Name

.text

Size

239KB

Virtual Size

238KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

88KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

FadeSEC.exe

bcrypt

user32

gdi32

advapi32

kernel32

generic