Bot_1[.]3[.]20[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Bot_1.3.20.exe
Size

7.1MB
MD5

5f9ea15b461020186e3c7aa995ef8152
SHA1

0b493e51aa5811361bf9b469ff47cf2f8bea9376
SHA256

e29d8b0f5e6288868256b10895ebbe3d1b65e3a9361707481c5d36c988ae1421
SHA512

4a493461dc51b76d0601c7960ba7888e353ee9a12e3b8389499ed5befe4ba09aed8e47ab673f7621d22c22cd0c52f6aac5e19bf4a4e2857a1cda19f83558ab5a
SSDEEP

98304:BtaA1Ul3q2So7hpnppiS/HoptUvA/v44:TaA1Ul3q2SKnDKptnvD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Bot_1.3.20.exe

Files

Bot_1.3.20.exe
.exe windows x64

d56ac925fff382e82dd81d47fc99995e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

d3d9

Direct3DCreate9Ex

d3dx9_43

D3DXMatrixInverse
D3DXVec3Normalize
D3DXVec2Normalize
D3DXCreateTextureFromFileExA
D3DXCreateFontA
D3DXCreateLine
D3DXCreateEffect
D3DXMatrixMultiply
D3DXCreateSprite
D3DXMatrixTransformation2D
D3DXVec4Transform

kernel32

CreateFileW
CloseHandle
WriteProcessMemory
OpenProcess
CreateToolhelp32Snapshot
K32GetModuleFileNameExA
Module32FirstW
VirtualAllocEx
ReadProcessMemory
Module32NextW
ReadFile
WritePrivateProfileStringA
GetPrivateProfileIntA
GetPrivateProfileStringA
GlobalAlloc
GlobalLock
DeviceIoControl
QueryPerformanceFrequency
QueryPerformanceCounter
FreeLibraryAndExitThread
CreateThread
GetModuleHandleW
K32EnumProcessModulesEx
K32GetModuleBaseNameA
K32GetModuleInformation
RtlCaptureContext
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateIoCompletionPort
GetTickCount
GetVersion
LocalAlloc
LoadLibraryA
GetSystemDirectoryA
GlobalUnlock
ReleaseSemaphore
WriteConsoleW
HeapSize
DeleteFileW
CreateSemaphoreA
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
HeapReAlloc
GetTimeZoneInformation
SetEndOfFile
CreatePipe
GetExitCodeProcess
WaitForSingleObject
SetStdHandle
ReadConsoleW
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
HeapFree
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
HeapAlloc
GetCommandLineW
GetCommandLineA
GetModuleFileNameW
SetConsoleCtrlHandler
GetFileType
GetConsoleMode
GetConsoleOutputCP
WriteFile
CreateProcessW
DuplicateHandle
ResumeThread
ExitThread
ExitProcess
RtlUnwind
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
RtlUnwindEx
InitializeSListHead
RtlLookupFunctionEntry
GetProcessHeap
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LocalFree
FormatMessageA
GetStdHandle
GetTempPathA
OutputDebugStringA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetWindowsDirectoryA
GetComputerNameA
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
RtlCaptureStackBackTrace
GetCurrentThreadId
GetSystemTimeAsFileTime
Sleep
GetCurrentProcess
WideCharToMultiByte
WaitForSingleObjectEx
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
GetCurrentDirectoryW
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
CreateEventW
AreFileApisANSI
GetLastError
GetProcAddress
GetFileInformationByHandleEx
MultiByteToWideChar
GetLocaleInfoEx
ReleaseSRWLockShared
AcquireSRWLockShared
RtlPcToFileHeader
RaiseException
IsProcessorFeaturePresent
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
GetModuleHandleExW
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
InitOnceComplete
InitOnceBeginInitialize
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetStringTypeW
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
RtlVirtualUnwind

user32

GetKeyState
VkKeyScanW
GetForegroundWindow
SetClipboardData
GetClipboardData
FindWindowA
VkKeyScanA
GetWindowThreadProcessId
GetCursorPos
GetWindowRect
SendInput
MapVirtualKeyA
EmptyClipboard
CloseClipboard
OpenClipboard
SetCursorPos
ReleaseCapture
GetClientRect
SetCursor
SetCapture
ClientToScreen
SetForegroundWindow
PostQuitMessage
UnregisterClassA
SetWindowLongW
SendMessageA
LoadCursorW
LoadIconW
TranslateMessage
SetLayeredWindowAttributes
MoveWindow
GetWindowLongW
DefWindowProcW
DestroyWindow
CreateWindowExW
RegisterClassExW
DestroyCursor
ShowWindow
GetAsyncKeyState
DispatchMessageW
DestroyIcon
PeekMessageW
GetCapture

gdi32

CreateSolidBrush
DeleteObject
CreateRectRgn

ws2_32

ntohs
setsockopt
socket
htons
getsockname
WSARecv
inet_pton
inet_ntop
connect
getsockopt
WSASetLastError
recv
inet_ntoa
getaddrinfo
bind
send
WSAGetLastError
accept
closesocket
ioctlsocket
htonl
listen
ntohl
getservbyname
getprotobynumber
freeaddrinfo
recvfrom
sendto
select
WSAIoctl
WSAStartup

dwmapi

DwmExtendFrameIntoClientArea
DwmEnableBlurBehindWindow

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

imm32

ImmGetContext
ImmSetCompositionWindow

dbghelp

UnDecorateSymbolName
SymInitialize
SymCleanup
SymSetOptions
SymFromAddr

ole32

CoGetObjectContext
CoGetApartmentType

iphlpapi

if_nametoindex

advapi32

RegCloseKey
RegQueryValueExA
CryptGenRandom
CryptAcquireContextA
RegOpenKeyExA

shell32

SHGetSpecialFolderPathA

Sections

.text
Size: 5.8MB - Virtual size: 5.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 934KB - Virtual size: 933KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 103KB - Virtual size: 271KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 265KB - Virtual size: 265KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d56ac925fff382e82dd81d47fc99995e

Headers

DLL Characteristics

File Characteristics

Imports

d3d9

d3dx9_43

kernel32

user32

gdi32

ws2_32

dwmapi

version

imm32

dbghelp

ole32

iphlpapi

advapi32

shell32

Sections

.text Size: 5.8MB - Virtual size: 5.8MB

.rdata Size: 934KB - Virtual size: 933KB

.data Size: 103KB - Virtual size: 271KB

.pdata Size: 265KB - Virtual size: 265KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 20KB - Virtual size: 19KB

.text
Size: 5.8MB - Virtual size: 5.8MB

.rdata
Size: 934KB - Virtual size: 933KB

.data
Size: 103KB - Virtual size: 271KB

.pdata
Size: 265KB - Virtual size: 265KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 20KB - Virtual size: 19KB