Static task
static1
Behavioral task
behavioral1
Sample
BOLOPatch4.00.exe
Resource
win10v2004-20230703-en
General
-
Target
BOLOPatch4.00.exe
-
Size
61KB
-
MD5
d7c19bdb968266b3e9866fbc2841e182
-
SHA1
92cb07266d202e6ee9e67714128368d7933b7fd8
-
SHA256
4820473d412960202d90e2d9fb70ab593ff624aff6f3cb98738d7bf4bdf37c21
-
SHA512
c49a75a3dbd27821b76d2573f2fd38733928c4c75d9aa3cca88ec6cdfe96a0d83726ec41c79d070ed4d17fec86d76aafa03f92fd44efccec02607d431563da55
-
SSDEEP
768:SoeUkZvxEdMKhA6Fzs+t4LOzboqMwJoPI8kflyQc9tf+3qAz5m1iR0/PqBWb7dg3:feUk7oh1s24KYhwqxTD+BG/PbWdo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource BOLOPatch4.00.exe
Files
-
BOLOPatch4.00.exe.exe windows x86
890909f36af4a92efb3e279cc95cd33b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcr90
_amsg_exit
exit
_wcsicmp
_encoded_null
_encode_pointer
_decode_pointer
__FrameUnwindFilter
_cexit
_crt_debugger_hook
_except_handler4_common
kernel32
ReadProcessMemory
Process32NextW
Process32FirstW
TerminateProcess
GetCurrentProcess
OpenProcess
SetUnhandledExceptionFilter
IsDebuggerPresent
CreateToolhelp32Snapshot
CloseHandle
GetLastError
WriteProcessMemory
UnhandledExceptionFilter
GetCurrentProcessId
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
Sleep
GetSystemTimeAsFileTime
msvcm90
?DoDllLanguageSupportValidation@<CrtImplementationDetails>@@YAXXZ
?RegisterModuleUninitializer@<CrtImplementationDetails>@@YAXP$AAVEventHandler@System@@@Z
?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@@Z
?ThrowNestedModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVException@System@@0@Z
?DoCallBackInDefaultDomain@<CrtImplementationDetails>@@YAXP6GJPAX@Z0@Z
?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@P$AAVException@3@@Z
user32
GetAsyncKeyState
advapi32
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
mscoree
_CorExeMain
Sections
.text Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 846B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ