FadeSEC_test[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
FadeSEC_test.exe
Size 734KB
Sample260721-tcbexaca93
SHA256 2ca48b973c34a1baa2c675a2d47b54dd0e164a00780e35e3b8df9702a3ffc561
MD5 9a777a5ddd0fa0fe4e30ae1ef61db00c
SHA1 ae0d48bb48ce8615ad7ee5e1ece6f1a31c17b1b1
SHA512 b85a867c80afcd146629b975ca8d3c201c6fd2e6bdfb2a373b1d1c1a15cfdeda02d2699807712b5a937cd56f9d242b0f5ae49ee935fbb109700a5e10fa155596
SSDEEP 6144:nLQrswtF4GAn7EcVD2Bp475S9iYlGyiXS37gIAIQrDM0wpGvMdCa6uZP48B0rDMd:nLQt0ZN2BSTwiiUIAIw8BNbIGCy
TLSH
T1BAF4F71AEB6290E8C5BFC039C852213AF9B0785643745BDB67804A574F277E8AF3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FadeSEC_test.exe

File Explorer

FadeSEC_test.exe

.exe 734KB

FadeSEC_test.exe

IMPHASH 3960681f5e1469ac457cc55384ebc254
SHA256 2ca48b973c34a1baa2c675a2d47b54dd0e164a00780e35e3b8df9702a3ffc561
MD5 9a777a5ddd0fa0fe4e30ae1ef61db00c
SHA1 ae0d48bb48ce8615ad7ee5e1ece6f1a31c17b1b1
SHA512 b85a867c80afcd146629b975ca8d3c201c6fd2e6bdfb2a373b1d1c1a15cfdeda02d2699807712b5a937cd56f9d242b0f5ae49ee935fbb109700a5e10fa155596
SSDEEP 6144:nLQrswtF4GAn7EcVD2Bp475S9iYlGyiXS37gIAIQrDM0wpGvMdCa6uZP48B0rDMd:nLQt0ZN2BSTwiiUIAIw8BNbIGCy
TLSH
T1BAF4F71AEB6290E8C5BFC039C852213AF9B0785643745BDB67804A574F277E8AF3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

288876

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpSendRequest WinHttpOpenRequest WinHttpSetTimeouts WinHttpSetOption WinHttpQueryDataAvailable WinHttpWriteData WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpReceiveResponse WinHttpOpen

rpcrt4

NdrClientCall3 UuidToStringW UuidCreate RpcStringBindingComposeW NdrServerCall2 NdrServerCallAll RpcBindingFromStringBindingW

mpr

WNetUseConnectionW

ole32

CoInitialize CoCreateGuid StringFromGUID2 CoCreateInstance CoInitializeEx CoUninitialize CLSIDFromProgID

oleaut32

SysStringLen VariantClear SysFreeString SysAllocString

advapi32

LogonUserExW CheckTokenMembership CreateProcessAsUserW OpenSCManagerW CreateServiceW ConvertStringSidToSidW LsaLookupNames LsaQueryInformationPolicy LsaOpenPolicy LsaClose StartServiceW QueryServiceStatusEx OpenServiceW DeleteService CryptDestroyHash CryptHashData CryptCreateHash CryptDecrypt CryptImportKey CryptGetHashParam CryptSetKeyParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW RegQueryInfoKeyA CreateProcessWithLogonW CreateWellKnownSid GetUserNameW SetTokenInformation RevertToSelf IsWellKnownSid ImpersonateLoggedOnUser GetTokenInformation GetLengthSid DuplicateTokenEx OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueA LookupPrivilegeValueW GetUserNameA RegCloseKey RegCreateKeyExW RegOpenKeyExA RegOpenKeyExW RegSetValueExA RegSetValueExW ChangeServiceConfig2W CloseServiceHandle

user32

GetAsyncKeyState SetWindowPos ShowWindow CreateWindowExA RegisterClassA PostQuitMessage DefWindowProcW PostMessageW DispatchMessageW TranslateMessage GetMessageW SetTimer EndPaint InvalidateRect GetClientRect FillRect FindWindowA FindWindowW SetWindowsHookExW GetSystemMetrics UnhookWindowsHookEx CallNextHookEx LoadCursorW SystemParametersInfoW wsprintfW SetForegroundWindow BeginPaint

gdi32

GetStockObject TextOutA MoveToEx SetTextColor SetBkMode SelectObject Rectangle LineTo GetTextExtentPoint32A DeleteObject CreateSolidBrush CreatePen CreateFontA

shlwapi

PathFindFileNameW

ws2_32

connect closesocket htons inet_addr recv WSAStartup gethostname select gethostbyname socket send ioctlsocket WSACleanup

bcrypt

BCryptDestroyKey BCryptFinalizeKeyPair BCryptImportKeyPair BCryptExportKey BCryptDecrypt BCryptEncrypt BCryptGenerateKeyPair BCryptGenRandom BCryptCloseAlgorithmProvider BCryptSetProperty BCryptOpenAlgorithmProvider BCryptGenerateSymmetricKey

netapi32

NetApiBufferFree NetShareEnum

offreg

ORGetValue OREnumKey ORQueryInfoKey ORCloseKey OROpenKey OROpenHive ORCloseHive

wininet

InternetOpenUrlW InternetReadFile InternetCloseHandle HttpQueryInfoW InternetOpenW

ntdll

NtClose NtCreateFile RtlNtStatusToDosError RtlInitUnicodeString RtlPcToFileHeader RtlUnwindEx

cabinet

ord20 ord22 ord23

cldapi

CfUnregisterSyncRoot CfConnectSyncRoot CfDisconnectSyncRoot CfExecute CfRegisterSyncRoot

kernel32

GetStringTypeW WriteConsoleW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent LCMapStringEx DecodePointer EncodePointer IsDebuggerPresent DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetFileInformationByHandleEx AreFileApisANSI GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose SetEndOfFile HeapSize GetConsoleOutputCP FlushFileBuffers SetStdHandle FreeEnvironmentStringsW GetSystemTimeAsFileTime GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType ReadConsoleW GetConsoleMode GetStdHandle GetLocaleInfoEx FormatMessageA SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetNativeSystemInfo ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount GetStartupInfoW InitializeSListHead QueryPerformanceCounter GetTempPathW RaiseException MultiByteToWideChar SystemTimeToFileTime ReadDirectoryChangesW MoveFileW CreateFileA CreateFileW DeleteFileA GetDriveTypeA GetFileAttributesW GetFileSizeEx ReadFile SetFileAttributesA SetFilePointerEx WriteFile lstrlenW GetTempPathA CloseHandle GetLastError AddVectoredExceptionHandler DeviceIoControl WaitForSingleObject Sleep WaitForMultipleObjects GetCurrentProcess TerminateProcess CreateThread ResumeThread CreateProcessW SetPriorityClass GetThreadContext SetThreadContext FlushInstructionCache OpenProcess GetTickCount GetSystemDirectoryW GetWindowsDirectoryA VirtualAlloc VirtualProtect VirtualAllocEx ReadProcessMemory WriteProcessMemory FreeLibrary GetModuleFileNameW GetModuleHandleA GetProcAddress LoadResource LockResource SizeofResource FindResourceW LoadLibraryA GetLogicalDriveStringsA CopyFileW MoveFileExA GetComputerNameA WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW ExpandEnvironmentStringsW CreateDirectoryW DeleteFileW LockFileEx RemoveDirectoryW SetFileInformationByHandle UnlockFile SetLastError HeapAlloc HeapFree GetProcessHeap GetOverlappedResult SetEvent CreateEventW GetCurrentProcessId GetCurrentThreadId OpenThread GetExitCodeThread SuspendThread ProcessIdToSessionId GetSystemTime GetModuleHandleW LoadLibraryW LocalFree

Name

.text

Size

441KB

Virtual Size

441KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

247KB

Virtual Size

246KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

FadeSEC_test.exe

winhttp

rpcrt4

mpr

ole32

oleaut32

advapi32

user32

gdi32

shlwapi

ws2_32

bcrypt

netapi32

offreg

wininet

ntdll

cabinet

cldapi

kernel32

generic