BulkFileChanger[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

BulkFileChanger.exe
Size

138KB
MD5

014b0d4834605cef9f8753dd764e6254
SHA1

01b8cf547e7c2d515dc93725d51ce75ed634d171
SHA256

b04d792e44f821da9bf92ea927a6dd72ecf23b15f738dc4f222c839f7242e9cd
SHA512

0e47bdf7bc01d2cf5de7beedbad9f299911521179ab3e7368e114152533238eee106b6859f879699a774d0dd3df734653d6d146b2515b98d90b1ea083ce305c9
SSDEEP

3072:Dayn0rJo2+7og8z/OWfpzsZ+wNHCFG6IdSEnvrZq9US6eFDd:CJoaffWZnC6yd

Score

10^/10

Malware Config

Signatures

Nirsoft 1 IoCs

resource	yara_rule
sample	Nirsoft

Files

BulkFileChanger.exe
.exe windows x64

ba479c0fff8850dbbe197c704d930927

Code Sign

f7:a0:a7:30:c8:7d:94:cd:83:02:e3:ea:7f:66:1b:b7
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/09/2019, 00:00

Not After

09/09/2023, 23:59

Subject

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

92:b4:e0:91:7d:95:ee:2e:4d:8f:e8:69:08:b8:1a:9f:58:ef:05:07:fd:09:93:f6:e8:57:e1:46:c1:a1:d0:fb
Signer

Actual PE Digest

92:b4:e0:91:7d:95:ee:2e:4d:8f:e8:69:08:b8:1a:9f:58:ef:05:07:fd:09:93:f6:e8:57:e1:46:c1:a1:d0:fb

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_initterm
__wgetmainargs
_wcmdln
exit
_cexit
_exit
_c_exit
_XcptFilter
__C_specific_handler
_onexit
__setusermatherr
_vsnwprintf
strlen
qsort
_purecall
_wcslwr
memmove
_memicmp
modf
_wtoi
wcstoul
wcsncpy
towupper
_commode
_fmode
__set_app_type
__dllonexit
wcsrchr
wcscmp
malloc
free
_snprintf
atoi
strcpy
_stricmp
memcmp
??3@YAXPEAX@Z
??2@YAPEAX_K@Z
_itow
wcslen
memcpy
abs
_wcsicmp
wcschr
wcscpy
memset
_snwprintf
wcsncat
wcscat

comctl32

ImageList_Create
ImageList_SetImageCount
ImageList_AddMasked
CreateStatusWindowW
CreateToolbarEx
ord17

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

kernel32

CreateProcessW
ReadProcessMemory
ExitProcess
GetCurrentProcessId
SetErrorMode
DeleteFileW
GlobalFree
GetCurrentDirectoryW
GetLocalTime
EnumResourceNamesW
GetPrivateProfileIntW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetCurrentProcess
OpenProcess
EnumResourceTypesW
GetStartupInfoW
SystemTimeToFileTime
SizeofResource
GetLocaleInfoW
GetLastError
CloseHandle
SetFileAttributesW
GetFileAttributesW
ExpandEnvironmentStringsW
FileTimeToSystemTime
CompareFileTime
CreateFileW
GetSystemTimeAsFileTime
SetFileTime
GetProcAddress
FreeLibrary
LoadLibraryW
SetFilePointer
GetFileTime
MultiByteToWideChar
GlobalLock
GetDateFormatW
GetTempFileNameW
FormatMessageW
GetFileSize
GetVersionExW
FindNextFileW
GetModuleHandleW
FindFirstFileW
FindClose
GetTimeFormatW
ReadFile
WriteFile
GetModuleFileNameW
GetWindowsDirectoryW
FileTimeToLocalFileTime
FindResourceW
GlobalAlloc
LocalFree
LoadResource
lstrlenW
lstrcpyW
GetNumberFormatW
LoadLibraryExW
WideCharToMultiByte
LockResource
LocalFileTimeToFileTime
GlobalUnlock
GetTempPathW

user32

IsDialogMessageW
RegisterClipboardFormatW
DispatchMessageW
KillTimer
GetClipboardData
SetTimer
DrawTextExW
GetSysColorBrush
ShowWindow
ChildWindowFromPoint
LoadCursorW
SetCursor
SendDlgItemMessageW
EndDialog
GetMessageW
GetDlgItem
GetDlgItemInt
InvalidateRect
EndPaint
GetWindow
DrawFrameControl
SetWindowTextW
SetDlgItemInt
UpdateWindow
SetDlgItemTextW
BeginPaint
GetDlgItemTextW
GetClientRect
GetSystemMetrics
DeferWindowPos
CreateWindowExW
GetWindowPlacement
LoadAcceleratorsW
DefWindowProcW
SendMessageW
RegisterClassW
MessageBoxW
PostMessageW
SetMenu
TranslateAcceleratorW
SetWindowPlacement
LoadImageW
SetWindowLongW
GetWindowLongW
BeginDeferWindowPos
EndDeferWindowPos
SetFocus
SetClipboardData
OpenClipboard
EmptyClipboard
ReleaseDC
CloseClipboard
GetDC
GetMenuItemCount
CheckMenuItem
GetMenuStringW
GetCursorPos
GetSysColor
EnableWindow
MapWindowPoints
GetMenu
GetParent
EnableMenuItem
GetClassNameW
GetSubMenu
MoveWindow
EnumChildWindows
LoadStringW
SetWindowPos
DestroyWindow
GetWindowTextW
LoadMenuW
ModifyMenuW
GetMenuItemInfoW
GetDlgCtrlID
DestroyMenu
DialogBoxParamW
CreateDialogParamW
LoadIconW
DestroyIcon
TranslateMessage
RegisterWindowMessageW
TrackPopupMenu
PostQuitMessage
GetWindowRect

gdi32

DeleteObject
SetTextColor
CreateFontIndirectW
SetBkMode
GetTextExtentPoint32W
GetStockObject
SetBkColor
SelectObject
GetDeviceCaps

comdlg32

FindTextW
GetSaveFileNameW
GetOpenFileNameW

shell32

SHGetPathFromIDListW
SHGetMalloc
SHGetFileInfoW
ShellExecuteW
ShellExecuteExW
DragAcceptFiles
DragFinish
DragQueryFileW
SHBrowseForFolderW

ole32

CoUninitialize
CoInitialize

Sections

.text
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ba479c0fff8850dbbe197c704d930927

Code Sign

f7:a0:a7:30:c8:7d:94:cd:83:02:e3:ea:7f:66:1b:b7Certificate

Extended Key Usages

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

92:b4:e0:91:7d:95:ee:2e:4d:8f:e8:69:08:b8:1a:9f:58:ef:05:07:fd:09:93:f6:e8:57:e1:46:c1:a1:d0:fbSigner

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

comctl32

version

kernel32

user32

gdi32

comdlg32

shell32

ole32

Sections

.text Size: 87KB - Virtual size: 87KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 1024B - Virtual size: 6KB

.pdata Size: 3KB - Virtual size: 3KB

.rsrc Size: 17KB - Virtual size: 17KB

f7:a0:a7:30:c8:7d:94:cd:83:02:e3:ea:7f:66:1b:b7
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

92:b4:e0:91:7d:95:ee:2e:4d:8f:e8:69:08:b8:1a:9f:58:ef:05:07:fd:09:93:f6:e8:57:e1:46:c1:a1:d0:fb
Signer

.text
Size: 87KB - Virtual size: 87KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 1024B - Virtual size: 6KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 17KB - Virtual size: 17KB