BERCon[.]exe | Triage

General

Target

BERCon.exe
Size

76KB
MD5

8742c015240d3807cda31988658f2b80
SHA1

7e89a31bbcbc780f3e2adc777995501f86079d6e
SHA256

41f929156e6d22b9e6bbfe0c8549153f807acdf5c85ec3e15efb019fe180a924
SHA512

e87372491f4e307a37a694c394f7b3a7c87a915e130f8c44800aa82728d6295cc93ee63642ffbd797cb2f03bba7c02dceb9d8ac0e8a7e0f89d239ad2a7df90aa
SSDEEP

1536:7Anri9NOIhh95z/kJeU2qw1dmPbcUub0YSctv:IYNVUTub0YSctv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BERCon.exe

Files

BERCon.exe
.exe windows x86

60c70c6eee37bda8e7dc61af09866f15

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WaitForSingleObject
ReadConsoleInputA
SetConsoleOutputCP
Sleep
GetTickCount
GetStdHandle
WriteConsoleA
CloseHandle
CreateFileA
HeapSize
ReadFile
LoadLibraryA
EnterCriticalSection
LeaveCriticalSection
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetLastError
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
ExitProcess
RaiseException
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetFilePointer
InitializeCriticalSection
RtlUnwind
GetConsoleOutputCP
WriteConsoleW
SetStdHandle

ws2_32

sendto
WSACleanup
closesocket
recvfrom
ioctlsocket
socket
htons
inet_addr
gethostbyname
WSAStartup

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

60c70c6eee37bda8e7dc61af09866f15

Headers

File Characteristics

Imports

kernel32

ws2_32

Sections

.text Size: 48KB - Virtual size: 47KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 8KB - Virtual size: 11KB

.text
Size: 48KB - Virtual size: 47KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 8KB - Virtual size: 11KB