Edit tour
Windows
Analysis Report
FaceFodUninstaller.exe
Overview
General Information
| Sample name: | FaceFodUninstaller.exe |
| Analysis ID: | 1606345 |
| MD5: | b6a30c5f8d5885b7b96e9bac7675165f |
| SHA1: | a7c572c7c5abc51131beb66d4c031337fef7f53c |
| SHA256: | aca626f6c2aafbce1f273d1bbc16fbe2120b40cd939c54f4442dd00946860a99 |
| Infos: |
Detection
| Score: | 1 |
| Range: | 0 - 100 |
| Confidence: | 60% |
Signatures
Binary contains a suspicious time stamp
PE file contains sections with non-standard names
Program does not show much activity (idle)
Classification
- System is w10x64
FaceFodUninstaller.exe (PID: 4292 cmdline: "C:\Users\ user\Deskt op\FaceFod Uninstalle r.exe" -in stall MD5: B6A30C5F8D5885B7B96E9BAC7675165F)
- FaceFodUninstaller.exe (PID: 3852 cmdline:
"C:\Users\ user\Deskt op\FaceFod Uninstalle r.exe" /in stall MD5: B6A30C5F8D5885B7B96E9BAC7675165F)
- FaceFodUninstaller.exe (PID: 1708 cmdline:
"C:\Users\ user\Deskt op\FaceFod Uninstalle r.exe" /lo ad MD5: B6A30C5F8D5885B7B96E9BAC7675165F)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
⊘No Suricata rule has matched
- • Compliance
- • System Summary
- • Data Obfuscation
- • Malware Analysis System Evasion
- • Anti Debugging
Click to jump to signature section
Show All Signature Results
There are no malicious signatures, click here to show all signatures.
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Classification label: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Thread injection, dropped files, key value created, disk infection and DNS query: | ||
| Source: | Thread injection, dropped files, key value created, disk infection and DNS query: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 2 Command and Scripting Interpreter | 1 DLL Side-Loading | 1 Process Injection | 1 Process Injection | OS Credential Dumping | 1 System Information Discovery | Remote Services | Data from Local System | Data Obfuscation | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | 1 DLL Side-Loading | 1 Timestomp | LSASS Memory | Application Window Discovery | Remote Desktop Protocol | Data from Removable Media | Junk Data | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 1 DLL Side-Loading | Security Account Manager | Query Registry | SMB/Windows Admin Shares | Data from Network Shared Drive | Steganography | Automated Exfiltration | Data Encrypted for Impact |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | ReversingLabs | |||
| 0% | Virustotal | Browse |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No contacted domains info
⊘No contacted IP infos
| Joe Sandbox version: | 42.0.0 Malachite |
| Analysis ID: | 1606345 |
| Start date and time: | 2025-02-04 10:23:31 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 1m 41s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Run name: | Cmdline fuzzy |
| Number of analysed new started processes analysed: | 4 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | FaceFodUninstaller.exe |
| Detection: | CLEAN |
| Classification: | clean1.winEXE@3/0@0/0 |
| Cookbook Comments: |
|
- Exclude process from analysis
(whitelisted): dllhost.exe
⊘No simulations
⊘No context
⊘No context
⊘No context
⊘No context
⊘No context
⊘No created / dropped files found
| File type: | |
| Entropy (8bit): | 5.782586456444767 |
| TrID: |
|
| File name: | FaceFodUninstaller.exe |
| File size: | 200'704 bytes |
| MD5: | b6a30c5f8d5885b7b96e9bac7675165f |
| SHA1: | a7c572c7c5abc51131beb66d4c031337fef7f53c |
| SHA256: | aca626f6c2aafbce1f273d1bbc16fbe2120b40cd939c54f4442dd00946860a99 |
| SHA512: | 76784ec5394e970ff01ea8d3e3e098b0f44514d11581f928bea4d5a800b6df5d8e6b32380c556ee63acf6824db204411b64add81d60ad2eaf53a5661d097e553 |
| SSDEEP: | 3072:OisfqOGnO3p6Bwp51imba7UiFrhoTvZkiV/m1K9zNYz5/w:SgO5YCLe7U1TJQ |
| TLSH: | 12143B6E36A510F5E17AC13DC9A30606F6B2B025072257EF02E1827E5F37BE4AD39B51 |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........J...+...+...+.......+...Se..+...+.../...+...+.......+.......+.......+.......+.......+.......+..Rich.+..................PE..d.. |
 | |
| Icon Hash: | 00928e8e8686b000 |
| Entrypoint: | 0x140002e40 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x140000000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE |
| DLL Characteristics: | HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x8DFAB0F7 [Sun Jun 25 15:19:19 2045 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 10 |
| OS Version Minor: | 0 |
| File Version Major: | 10 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 10 |
| Subsystem Version Minor: | 0 |
| Import Hash: | 3ec1a21d0b6c30661ca255aa06e9d9e1 |
| Instruction |
|---|
| dec eax |
| sub esp, 28h |
| call 00007F466C64DE70h |
| dec eax |
| add esp, 28h |
| jmp 00007F466C64D5C3h |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| nop word ptr [eax+eax+00000000h] |
| dec eax |
| cmp ecx, dword ptr [0002A809h] |
| jne 00007F466C64D762h |
| dec eax |
| rol ecx, 10h |
| test cx, FFFFh |
| jne 00007F466C64D753h |
| ret |
| dec eax |
| ror ecx, 10h |
| jmp 00007F466C64DB07h |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| jmp 00007F466C64DC60h |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| inc eax |
| push ebx |
| dec eax |
| sub esp, 20h |
| dec eax |
| lea eax, dword ptr [0001E15Bh] |
| dec eax |
| mov ebx, ecx |
| dec eax |
| mov dword ptr [ecx], eax |
| test dl, 00000001h |
| je 00007F466C64D757h |
| call 00007F466C64DC3Ch |
| dec eax |
| mov eax, ebx |
| dec eax |
| add esp, 20h |
| pop ebx |
| ret |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| dec eax |
| sub esp, 28h |
| call 00007F466C64E258h |
| test eax, eax |
| je 00007F466C64D773h |
| dec eax |
| mov eax, dword ptr [00000030h] |
| dec eax |
| mov ecx, dword ptr [eax+08h] |
| jmp 00007F466C64D757h |
| dec eax |
| cmp ecx, eax |
| je 00007F466C64D766h |
| xor eax, eax |
| dec eax |
| cmpxchg dword ptr [0002A880h], ecx |
| jne 00007F466C64D740h |
| xor al, al |
| dec eax |
| add esp, 28h |
| ret |
| mov al, 01h |
| jmp 00007F466C64D749h |
| int3 |
| int3 |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x2ab90 | 0x190 | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x31000 | 0x1a10 | .pdata |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x33000 | 0x310 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x26248 | 0x70 | .rdata |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x21bf0 | 0x28 | .rdata |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x21ab0 | 0x140 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x21c18 | 0x688 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x1e68c | 0x1f000 | 509522cc8cfc02fc5a89862d075e531d | False | 0.4787203881048387 | data | 6.146274402628442 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| fothk | 0x20000 | 0x1000 | 0x1000 | faeee59f1a8533621b93863f9d9740af | False | 0.009033203125 | ISO-8859 text, with very long lines (4096), with no line terminators | 0.015920183265625623 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x21000 | 0xb4e8 | 0xc000 | 5fff278daef684ee273ac3039f451990 | False | 0.3241373697916667 | data | 4.611931688476528 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0x2d000 | 0x3360 | 0x1000 | 4da75e6230889b6892d3a5d8f1ff9ed4 | False | 0.10205078125 | data | 1.5863595336812693 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .pdata | 0x31000 | 0x1a10 | 0x2000 | 84421c2bb7778d6ff66e9855cda1daee | False | 0.39990234375 | data | 4.444561887826421 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0x33000 | 0x368 | 0x1000 | 940d2a7fb6c58ba96328746b6c61d930 | False | 0.13671875 | data | 1.6894449076576266 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| DLL | Import |
|---|---|
| api-ms-win-crt-string-l1-1-0.dll | strcspn, wcsnlen, memset, wcscmp |
| api-ms-win-crt-locale-l1-1-0.dll | _lock_locales, _unlock_locales |
| api-ms-win-crt-runtime-l1-1-0.dll | _register_thread_local_exe_atexit_callback, _initterm, _c_exit, _initterm_e |
| api-ms-win-crt-private-l1-1-0.dll | _o__errno, _o__exit, _o__get_wide_winmain_command_line, _o__initialize_onexit_table, _o__initialize_wide_environment, _o__invalid_parameter_noinfo, _o__invalid_parameter_noinfo_noreturn, _o__ldclass, _o__purecall, _o__register_onexit_function, _o__seh_filter_exe, _o__set_app_type, _o__set_fmode, _o__set_new_mode, memmove, _o__wcsdup, _o__wcsicmp, _o__wcsnicmp, _o__wtof, _o__wtoi, _o_abort, _o_calloc, _o_exit, _o_free, _o_frexp, _o_localeconv, _o_malloc, _o_setlocale, _o_terminate, _o_wcscpy_s, __uncaught_exception, __C_specific_handler, __current_exception, __current_exception_context, _CxxThrowException, _o__dclass, _o__crt_atexit, _o__configure_wide_argv, _o__configthreadlocale, _o__cexit, _o__calloc_base, _o__callnewh, _o___stdio_common_vswprintf, _o___stdio_common_vsprintf_s, _o___std_exception_destroy, _o___std_exception_copy, _o___pctype_func, wcsrchr, _o___p__commode, _o____mb_cur_max_func, _o____lc_locale_name_func, _o____lc_codepage_func, __CxxFrameHandler3, memcmp, memcpy |
| KERNEL32.dll | AcquireSRWLockShared, SetEvent, GetModuleFileNameA, HeapFree, GetModuleHandleExW, GetCurrentThreadId, FormatMessageW, HeapAlloc, CreateEventW, GetProcAddress, GetProcessHeap, GetModuleHandleW, WideCharToMultiByte, DebugBreak, GetLastError, OutputDebugStringW, IsDebuggerPresent, CloseHandle, SetLastError, WaitForSingleObject, ReleaseSemaphore, OpenSemaphoreW, EnterCriticalSection, LeaveCriticalSection, ReleaseMutex, GetCurrentProcessId, CreateMutexExW, CreateSemaphoreExW, WaitForSingleObjectEx, MultiByteToWideChar, QueryPerformanceFrequency, InitializeCriticalSectionAndSpinCount, GetStringTypeW, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, RtlCaptureContext, VerifyVersionInfoW, VerSetConditionMask, ExitProcess, WTSGetActiveConsoleSessionId, HeapReAlloc, GlobalFree, GetSystemDirectoryW, GetFileAttributesW, CreateMutexW, GetProductInfo, GetUserDefaultLocaleName, InitializeCriticalSection, CreateThreadpoolTimer, ReleaseSRWLockShared, ResetEvent, CloseThreadpoolTimer, WaitForThreadpoolTimerCallbacks, SetThreadpoolTimer, InitializeSRWLock, AcquireSRWLockExclusive, ReleaseSRWLockExclusive, LoadLibraryExW, FreeLibrary, GetStartupInfoW, InitializeSListHead, GetSystemTimeAsFileTime, QueryPerformanceCounter, IsProcessorFeaturePresent, TerminateProcess, GetCurrentProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, RtlVirtualUnwind, RtlLookupFunctionEntry |
| SHLWAPI.dll | StrTrimW |
| WTSAPI32.dll | WTSFreeMemory, WTSEnumerateSessionsW, WTSQueryUserToken |
| api-ms-win-core-registry-l1-1-0.dll | RegQueryInfoKeyW, RegCreateKeyExW, RegDeleteTreeW, RegEnumValueW, RegCloseKey, RegOpenKeyExW, RegSetValueExW, RegGetValueW |
| api-ms-win-core-com-l1-1-0.dll | CoUninitialize, CoCreateInstance, StringFromGUID2, CoTaskMemFree, CoCreateGuid |
| api-ms-win-eventing-provider-l1-1-0.dll | EventUnregister, EventRegister, EventSetInformation, EventActivityIdControl, EventWriteTransfer |
| api-ms-win-stateseparation-helpers-l1-1-0.dll | GetPersistedFileLocationW, GetPersistedRegistryLocationW |
| WINHTTP.dll | WinHttpQueryHeaders, WinHttpReadData, WinHttpOpenRequest, WinHttpOpen, WinHttpReceiveResponse, WinHttpCloseHandle, WinHttpGetIEProxyConfigForCurrentUser, WinHttpQueryAuthSchemes, WinHttpGetProxyForUrl, WinHttpSendRequest, WinHttpSetCredentials, WinHttpConnect, WinHttpSetOption, WinHttpQueryDataAvailable, WinHttpGetDefaultProxyConfiguration |
| api-ms-win-core-version-l1-1-1.dll | GetFileVersionInfoW, GetFileVersionInfoSizeW |
| api-ms-win-core-version-l1-1-0.dll | VerQueryValueW |
| ntdll.dll | RtlGetDeviceFamilyInfoEnum, RtlConvertDeviceFamilyInfoToString |
| api-ms-win-security-base-l1-1-0.dll | RevertToSelf, ImpersonateLoggedOnUser |
| api-ms-win-core-winrt-l1-1-0.dll | RoUninitialize, RoInitialize |
| api-ms-win-security-credentials-l1-1-0.dll | CredReadW, CredFree |
| ole32.dll | CoInitialize, CoGetObject |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node⊘No network behavior found
Click to jump to process
Click to jump to process
Click to jump to process
| Target ID: | 0 |
| Start time: | 04:24:20 |
| Start date: | 04/02/2025 |
| Path: | C:\Users\user\Desktop\FaceFodUninstaller.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff6b2b50000 |
| File size: | 200'704 bytes |
| MD5 hash: | B6A30C5F8D5885B7B96E9BAC7675165F |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | true |
| Target ID: | 2 |
| Start time: | 04:24:23 |
| Start date: | 04/02/2025 |
| Path: | C:\Users\user\Desktop\FaceFodUninstaller.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff6b2b50000 |
| File size: | 200'704 bytes |
| MD5 hash: | B6A30C5F8D5885B7B96E9BAC7675165F |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | true |
| Target ID: | 3 |
| Start time: | 04:24:25 |
| Start date: | 04/02/2025 |
| Path: | C:\Users\user\Desktop\FaceFodUninstaller.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff6b2b50000 |
| File size: | 200'704 bytes |
| MD5 hash: | B6A30C5F8D5885B7B96E9BAC7675165F |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | true |
⊘No disassembly
