Static task
static1
Behavioral task
behavioral1
Sample
BONZIFY.exe
Resource
win7-20230220-en
General
-
Target
The Big Bang.iso
-
Size
6.9MB
-
MD5
2c0fcd3dcdc31f3c8a19a43a60900ce7
-
SHA1
9127ffc5915e3142410f164ad8fbe4e4029be097
-
SHA256
b553b401f8d8fa47db7f3b513637145453337159d0acca460b4efcdaf5ef5c61
-
SHA512
5903ee1db1677acd91ffab49494af43a2d80add3c1c785a104b1737fc7f158507019a267e6380a95482da8bb9c1d8006b6bed6855fbc9e54e30394a814ed123f
-
SSDEEP
196608:LdAMaWetTeAkLIdx751qFTkub//73lc6u7b5VJ2Yx5xIdk3:raWedh+Idx75QYub//73lc6u7bLMYxD
Malware Config
Signatures
Files
-
The Big Bang.iso.iso
-
BONZIFY.EXE.exe windows x86
0bee32f8779ce7af7a869e923f1dd6fb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindClose
lstrcmpA
lstrcatA
CreateFileA
lstrcpyA
CloseHandle
LocalFree
GetProcessHeap
FlushFileBuffers
Sleep
DeleteFileA
CreateThread
HeapAlloc
SizeofResource
lstrlenA
SetLastError
TerminateProcess
ExpandEnvironmentStringsA
GetFullPathNameA
FindResourceA
WaitForSingleObject
OpenProcess
CreateToolhelp32Snapshot
LockResource
Process32Next
LoadResource
lstrcmpiA
CreateProcessA
FindNextFileA
WriteFile
HeapFree
FindFirstFileA
Process32First
LocalAlloc
user32
SendMessageA
advapi32
RegOpenKeyA
RegSetValueExA
RegCloseKey
shell32
SHCreateDirectoryExA
SHChangeNotify
ole32
CoInitialize
CoCreateInstance
oleaut32
SysAllocString
SysFreeString
shlwapi
PathRemoveFileSpecA
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6.4MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 452B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ