fadok | Konspekt_literaturnogo_chtenia_na_temu_Otryvki_iz_romana_Evgeniy_Onegin__2_klass[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Konspekt_literaturnogo_chtenia_na_temu_Otryvki_iz_romana_Evgeniy_Onegin__2_klass.exe
Size 1.6MB
Sample260908-pma5nsbl4x
SHA256 2e966d34801be95eae9a7f1dd5efe3885c234c473d377185f3b7af4dbbb99d2e
MD5 fc7ba2336d7a69b388a1b103f2db8eee
SHA1 260c49e336bf3aaaba4cd49c0223a200730d3817
SHA512 4fd2f24b99ab253579620a31565b231d3f5d2598381f5d988504468eed5d7ec560227509c571e8feb0b838e739777015b296ae045610f5767503302569f78670
SSDEEP 24576:DLILY8Xu/3y8UsG2BgYLicwnkyCHdebUKyZURQ1TgjTm:EYrC8UsGuTw3CHdeQKyZURQ1EjTm
TLSH
T1D5755BE2F181C4B6E81301B18D3D9F20255ABE79576465DB628E772E4AB32C32477E0F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm fadok

Malware Config

Extracted

Family

fadok

http://wxanalytics.ru/net.exe.config
http://wxanalytics.ru/net.exe

Signatures

Family: Fadok, Fakedoc
Fadok aka Fakedoc is a worm written in C++.
worm fadok

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Konspekt_literaturnogo_chtenia_na_temu_Otryvki_iz_romana_Evgeniy_Onegin__2_klass.exe

File Explorer

Konspekt_literaturnogo_chtenia_na_temu_Otryvki_iz_romana_Evgeniy_Onegin__2_klass.exe

.exe 1.6MB

Konspekt_literaturnogo_chtenia_na_temu_Otryvki_iz_romana_Evgeniy_Onegin__2_klass.exe

IMPHASH e9a18295b3fe00449f587b8a33bc0e3e
SHA256 2e966d34801be95eae9a7f1dd5efe3885c234c473d377185f3b7af4dbbb99d2e
MD5 fc7ba2336d7a69b388a1b103f2db8eee
SHA1 260c49e336bf3aaaba4cd49c0223a200730d3817
SHA512 4fd2f24b99ab253579620a31565b231d3f5d2598381f5d988504468eed5d7ec560227509c571e8feb0b838e739777015b296ae045610f5767503302569f78670
SSDEEP 24576:DLILY8Xu/3y8UsG2BgYLicwnkyCHdebUKyZURQ1TgjTm:EYrC8UsGuTw3CHdeQKyZURQ1EjTm
TLSH
T1D5755BE2F181C4B6E81301B18D3D9F20255ABE79576465DB628E772E4AB32C32477E0F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

370885

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

P:\MultiLauncher\Release\MultiLauncher.pdb

kernel32

ReleaseMutex FreeResource FindResourceW FreeLibrary LoadResource LoadLibraryExW SizeofResource LockResource EndUpdateResourceW BeginUpdateResourceW UpdateResourceW ConnectNamedPipe CreateNamedPipeW GetLastError CreateThread FindFirstFileW PeekNamedPipe GetLogicalDriveStringsW GetModuleFileNameW FindClose FindNextFileW SetFileAttributesW ExpandEnvironmentStringsW GetModuleHandleW WaitForSingleObject CreateMutexW DeleteFileW GetFileAttributesW CopyFileW Sleep MoveFileExW GetTickCount SetLastError InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection VerSetConditionMask SleepEx VerifyVersionInfoA FormatMessageA GetProcAddress WaitForMultipleObjects GetFileType GetStdHandle LoadLibraryA ExpandEnvironmentStringsA WideCharToMultiByte InterlockedIncrement InterlockedDecrement MultiByteToWideChar GetStringTypeW GetCurrentThreadId EncodePointer DecodePointer InterlockedExchange DuplicateHandle GetCurrentProcess GetCurrentThread GetSystemTimeAsFileTime GetCommandLineW HeapFree FileTimeToLocalFileTime FindFirstFileExW FileTimeToSystemTime HeapAlloc GetCPInfo IsDebuggerPresent IsProcessorFeaturePresent GetDriveTypeW ExitThread SetFilePointerEx GetFileInformationByHandle GetCurrentProcessId RaiseException RtlUnwind InitializeCriticalSectionAndSpinCount CreateTimerQueue CreateTimerQueueTimer TlsGetValue UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess TlsAlloc TlsSetValue TlsFree GetStartupInfoW CreateSemaphoreW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ExitProcess GetModuleHandleExW AreFileApisANSI GetProcessHeap QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW HeapSize FlushFileBuffers GetConsoleCP GetConsoleMode GetFullPathNameW GetCurrentDirectoryW IsValidCodePage GetACP GetOEMCP GetTimeZoneInformation ReadConsoleW SetStdHandle DeleteTimerQueueTimer GetProcessAffinityMask SetThreadAffinityMask OutputDebugStringW SwitchToThread GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA SetEvent CreateEventW SetThreadPriority GetVersionExW VirtualAlloc VirtualFree VirtualProtect ReleaseSemaphore InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx ChangeTimerQueueTimer GetNumaHighestNodeNumber RegisterWaitForSingleObject LoadLibraryW WriteConsoleW SetEndOfFile SetEnvironmentVariableA GetThreadPriority UnregisterWait SignalObjectAndWait ReadFile SetFilePointer CloseHandle CreateFileW HeapReAlloc WriteFile

advapi32

CryptEncrypt CryptGetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextA CryptImportKey CryptCreateHash CryptHashData CryptDestroyHash RegSetValueExW RegCloseKey RegOpenKeyExW RegOpenKeyW RegQueryValueExW

shell32

SHCreateDirectoryExW ShellExecuteW

ws2_32

socket WSAIoctl getaddrinfo freeaddrinfo setsockopt sendto accept listen ioctlsocket gethostname ntohs htons getsockopt getsockname getpeername connect closesocket bind send recv WSASetLastError select __WSAFDIsSet WSAGetLastError WSACleanup WSAStartup recvfrom

wldap32

ord301 ord200 ord30 ord79 ord35 ord33 ord32 ord27 ord26 ord22 ord41 ord50 ord60 ord211 ord46 ord143