faes[.]wtf[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
faes.wtf.exe
Size 12.2MB
Sample261022-w95fcstshv
SHA256 f05e84fcde8c93aaa22d4ca4fafe73d7f4cb81ff85c787461254142eb1b9cc47
MD5 0c17eff1f20a6322312f147550a7b437
SHA1 5b098a4f5f70144daf2015ef3060163cf70984c2
SHA512 20e4e4b152964720f0354c02a2714c8ea1502e2642bee5ef9593c73479656874f5bf3d2adde52aba9c42efd85e9f4b97ee22e30f47891493b1c406b166d56a32
SSDEEP 98304:o8SaEhX9Vo9J0bRu8eOlBcQdHfIE2zApGXqiMfkttyeOlBcQdHfImFO6ZN6jlfun:oNaSzlKKBc0cA8XyEKBc0fO6ZNOp
TLSH
T138D64A157A9B996CD04BC474838B8662093130DB0B39A9FF54D4963C2FAEBF52F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
faes.wtf.exe

File Explorer

faes.wtf.exe

.exe 12.2MB

faes.wtf.exe

IMPHASH 64510a790cb94e8fafecb9a901c6e0a8
SHA256 f05e84fcde8c93aaa22d4ca4fafe73d7f4cb81ff85c787461254142eb1b9cc47
MD5 0c17eff1f20a6322312f147550a7b437
SHA1 5b098a4f5f70144daf2015ef3060163cf70984c2
SHA512 20e4e4b152964720f0354c02a2714c8ea1502e2642bee5ef9593c73479656874f5bf3d2adde52aba9c42efd85e9f4b97ee22e30f47891493b1c406b166d56a32
SSDEEP 98304:o8SaEhX9Vo9J0bRu8eOlBcQdHfIE2zApGXqiMfkttyeOlBcQdHfImFO6ZN6jlfun:oNaSzlKKBc0cA8XyEKBc0fO6ZNOp
TLSH
T138D64A157A9B996CD04BC474838B8662093130DB0B39A9FF54D4963C2FAEBF52F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6157472

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

preazy_loader_tauri.pdb

shell32

ShellExecuteW SHGetStockIconInfo DragFinish SHAppBarMessage DragQueryFileW SHGetKnownFolderPath

bcryptprimitives

ProcessPrng

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey RegGetValueW EventRegister EventUnregister EventWriteTransfer EventSetInformation

ntdll

RtlGetVersion NtOpenFile NtCreateNamedPipeFile NtWriteFile RtlNtStatusToDosError

kernel32

HeapAlloc GetCurrentThreadId RtlPcToFileHeader FormatMessageW LoadLibraryExW GetSystemTimeAsFileTime OutputDebugStringA GetLastError GetFileAttributesW GetFileInformationByHandle GetConsoleMode LoadLibraryExA GetModuleHandleExW SetThreadErrorMode OutputDebugStringW GetModuleHandleA Sleep CloseHandle GetProcAddress GetModuleFileNameW LoadLibraryA LoadLibraryW GetProcessHeap HeapFree FreeLibrary GetModuleHandleW lstrlenW ReleaseSRWLockExclusive GetUserDefaultUILanguage LCIDToLocaleName EncodePointer FlsGetValue RaiseException SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive RtlUnwindEx SetUnhandledExceptionFilter InitializeSListHead FindNextFileW QueryPerformanceFrequency GetTempPathW FlsSetValue IsThreadAFiber FlsAlloc FlsFree SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW MultiByteToWideChar SetEnvironmentVariableW GetFinalPathNameByHandleW ReleaseMutex CreateMutexA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread GetSystemInfo ExitProcess FindClose FindFirstFileExW GetCommandLineW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee CreateDirectoryW GetEnvironmentStringsW CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetFileInformationByHandleEx SetFileTime GetSystemTimePreciseAsFileTime RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WriteFileEx SleepEx ReadFileEx GetCurrentProcessId CreateThread QueryPerformanceCounter HeapReAlloc DuplicateHandle GetCurrentProcess GetStdHandle SetFileInformationByHandle GetFullPathNameW SetLastError WaitForSingleObject FreeEnvironmentStringsW CompareStringOrdinal GetEnvironmentVariableW CreateFileW InitializeCriticalSectionEx AddVectoredExceptionHandler DeleteCriticalSection

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

user32

TranslateMessage GetMessageW ChangeDisplaySettingsExW IsIconic RedrawWindow AdjustWindowRect PeekMessageW SetWindowPlacement GetWindowPlacement SetWindowPos InvalidateRgn LoadCursorW SetCursor FlashWindowEx ClientToScreen SetCursorPos InvalidateRect UpdateWindow GetActiveWindow GetForegroundWindow GetSystemMetrics RegisterTouchWindow ValidateRect GetUpdateRect DispatchMessageW ScreenToClient GetWindowLongW GetClientRect FillRect TrackMouseEvent GetTouchInputInfo CloseTouchInputHandle MonitorFromRect SystemParametersInfoW GetCursorPos MonitorFromWindow GetMonitorInfoW PostMessageW TranslateAcceleratorW GetMessageA EnumChildWindows DestroyIcon LoadImageW GetIconInfo MapVirtualKeyW IsProcessDPIAware GetDC ReleaseDC IsWindowEnabled PostThreadMessageW CreateWindowExW SendMessageW DestroyWindow SetWindowRgn DrawTextW GetWindowDC OffsetRect GetMenuBarInfo VkKeyScanW DestroyMenu PostQuitMessage TrackPopupMenu AppendMenuW InsertMenuW AdjustWindowRectEx SetMenuItemInfoW CheckMenuItem RemoveMenu CreatePopupMenu CreateMenu DrawMenuBar SetMenu CreateAcceleratorTableW DrawIconEx GetMenuItemInfoW DestroyAcceleratorTable CreateIcon GetAsyncKeyState GetKeyboardState GetKeyState MapVirtualKeyExW ToUnicodeEx SystemParametersInfoA SetPropW SendInput SetForegroundWindow SetWindowTextW GetWindowTextW GetWindowTextLengthW GetRawInputData GetKeyboardLayout GetMenu IsWindowVisible EnumDisplayMonitors MonitorFromPoint SetWindowDisplayAffinity ClipCursor GetClipCursor ShowCursor SetWindowLongW EnableMenuItem GetSystemMenu ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx RegisterClassExW RegisterRawInputDevices EnableWindow DefWindowProcW RegisterWindowMessageA GetWindow SetParent MapWindowPoints SetFocus ShowWindow GetWindowRect SetWindowLongPtrW GetParent GetWindowLongPtrW FindWindowExW DispatchMessageA

gdi32

GetDeviceCaps CreateDIBSection CreateSolidBrush CreateRectRgn DeleteObject BitBlt CombineRgn SetBkMode SetTextColor CreateCompatibleDC GetDIBits SelectObject DeleteDC

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute DwmGetWindowAttribute

ole32

RevokeDragDrop CoUninitialize CoInitializeEx OleInitialize CoCreateInstance RegisterDragDrop

shlwapi

SHCreateMemStream

comctl32

TaskDialogIndirect RemoveWindowSubclass SetWindowSubclass DefSubclassProc

combase

CoTaskMemFree CoTaskMemAlloc CoCreateFreeThreadedMarshaler

imm32

ImmGetContext ImmGetCompositionStringW ImmReleaseContext

oleaut32

GetErrorInfo SetErrorInfo SysFreeString SysStringLen

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

api-ms-win-crt-math-l1-1-0

round floor trunc roundf __setusermatherr pow

api-ms-win-crt-string-l1-1-0

wcscmp strcpy_s wcslen _wcsicmp

api-ms-win-crt-convert-l1-1-0

wcstol _ultow_s _wtoi

api-ms-win-crt-runtime-l1-1-0

_exit exit _initterm_e _initterm __p___argc _initialize_narrow_environment _configure_narrow_argv __p___argv _set_app_type _seh_filter_exe _cexit _c_exit terminate abort _register_thread_local_exe_atexit_callback _crt_atexit _register_onexit_function _get_initial_narrow_environment _initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc calloc free _callnewh