HEUR-Trojan[.]Win32[.]Bsymem[.]gen-4b48994ace29b4a9[.]exe

General

Target
HEUR-Trojan.Win32.Bsymem.gen-4b48994ace29b4a9.exe
Size 401KB
Sample230105-azbveaab66
SHA256 4b48994ace29b4a93669f1856a28c0b7d0c4a1f5155b30fd11de85dd350f5bd5
MD5 676f6fc4947933bb287a2138a9c478fa
SHA1 23986f7cf5c250177d849a48cd9bd43e167ce214
SHA512 1148a1aafceee1a78d100cb56f391254ca64042f04933076cbd82009032918e980bcdaf60f0ca053b98ac1a6fa5ba619611beb22f2d94f11335ac5a86af1daa7
SSDEEP 6144:mxfoVsYxTvrreG/PnKcdlQPnTEtHPK8MtSc7lBPFDPbWj5c4yac:m01TneG/PnKcdanoeDCj
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

HEUR-Trojan.Win32.Bsymem.gen-4b48994ace29b4a9.exe

.exe 401KB

HEUR-Trojan.Win32.Bsymem.gen-4b48994ace29b4a9.exe

IMPHASH f0bfc1cc0e395e0b7ca1dd0906a94aca
SHA256 4b48994ace29b4a93669f1856a28c0b7d0c4a1f5155b30fd11de85dd350f5bd5
MD5 676f6fc4947933bb287a2138a9c478fa
SHA1 23986f7cf5c250177d849a48cd9bd43e167ce214
SHA512 1148a1aafceee1a78d100cb56f391254ca64042f04933076cbd82009032918e980bcdaf60f0ca053b98ac1a6fa5ba619611beb22f2d94f11335ac5a86af1daa7
SSDEEP 6144:mxfoVsYxTvrreG/PnKcdlQPnTEtHPK8MtSc7lBPFDPbWj5c4yac:m01TneG/PnKcdanoeDCj
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

32064

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetComputerNameA SearchPathW WritePrivateProfileStructA GetConsoleAliasesLengthW TlsGetValue SetLocalTime CommConfigDialogA FindResourceExW GetProcessIoCounters MapUserPhysicalPages FreeLibrary CallNamedPipeA GetCommState InterlockedDecrement ZombifyActCtx ScrollConsoleScreenBufferW SetDefaultCommConfigW GetSystemWindowsDirectoryW GetNamedPipeHandleStateA GlobalLock SetConsoleScreenBufferSize WriteConsoleInputA SetComputerNameW CreateDirectoryExA GetModuleHandleW CreateNamedPipeW GetPrivateProfileStringW WriteFileGather SetProcessPriorityBoost GetSystemDirectoryW LoadLibraryW GetConsoleMode SetCommConfig SizeofResource GetSystemWow64DirectoryW GetSystemTimeAdjustment InterlockedPopEntrySList GlobalFlags ReadFile GetBinaryTypeW GetOverlappedResult CompareStringW ExitThread lstrlenW GetStartupInfoW VerifyVersionInfoW CreateDirectoryA GetProfileIntA GetFileSizeEx SetCurrentDirectoryA OpenMutexW GetCurrentDirectoryW GetThreadLocale ReadConsoleOutputCharacterA GetProcessHeaps SetVolumeLabelW WriteProfileSectionA SetStdHandle GetAtomNameA LoadLibraryA LocalAlloc SetCalendarInfoW SetConsoleCtrlHandler SetConsoleWindowInfo GetTapeParameters WTSGetActiveConsoleSessionId SetConsoleTitleW GetProcessShutdownParameters CreateMutexA FreeEnvironmentStringsW RequestWakeupLatency VirtualProtect GetCPInfoExA GetVersionExA FindAtomW GetWindowsDirectoryW GetVersion GetVolumeNameForVolumeMountPointW DeleteFileW FindActCtxSectionStringW GetProfileSectionW LCMapStringW CopyFileExA CommConfigDialogW InterlockedIncrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleFileNameW GetCommandLineA GetStartupInfoA HeapValidate IsBadReadPtr RaiseException RtlUnwind GetLastError GetFileType WriteFile WideCharToMultiByte GetConsoleCP GetProcAddress TlsAlloc TlsSetValue GetCurrentThreadId TlsFree SetLastError GetACP GetOEMCP GetCPInfo IsValidCodePage DebugBreak GetStdHandle OutputDebugStringA WriteConsoleW OutputDebugStringW ExitProcess QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount HeapDestroy HeapCreate HeapFree VirtualFree FlushFileBuffers HeapAlloc HeapSize HeapReAlloc VirtualAlloc MultiByteToWideChar GetStringTypeA GetStringTypeW GetLocaleInfoA InitializeCriticalSectionAndSpinCount WriteConsoleA GetConsoleOutputCP SetFilePointer LCMapStringA CreateFileA CloseHandle GetModuleHandleA

user32

GetComboBoxInfo GetCursorInfo

Name

.text

Size

266KB

Virtual Size

265KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

47KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

193B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

63KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

HEUR-Trojan.Win32.Bsymem.gen-4b48994ace29b4a9.exe

kernel32

user32