bfsvc[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

bfsvc.exe
Size

100KB
MD5

149b5294672f6d611945b901832f455a
SHA1

7607cece2f794d57a719340b63fd0408fb5fc6eb
SHA256

b4bc1908f636e8bcbe6dddcd6dea9a4b29d96691595fc10205ddb270b84e41cf
SHA512

92b6e4f02fae1594ed65a0ff2c8770fee68c599384a1b49e880cf9612605b57eafdd0d3c9907074db21bfa03a840d9bd6534d6ed5f82d72763c255e1c9690b91
SSDEEP

1536:f/0hcbnpWUj8tlf0nJ+ddqXxNft9QK8d5sctYeu0BKREg:hpWntl+IdqXxNft9mAcqeu0oRl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bfsvc.exe

Files

bfsvc.exe
.exe windows x64

076152a38ca83ca117b6fdb82409f937

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_wcsicmp
_fmode
_vsnwprintf
__C_specific_handler
_initterm
__setusermatherr
_cexit
_wcsnicmp
_exit
exit
wcsrchr
_commode
__set_app_type
__wgetmainargs
_vsnwprintf_s
fwprintf
swprintf_s
wcsncmp
_amsg_exit
_snwscanf_s
wcschr
__iob_func
memcpy
?terminate@@YAXXZ
wcsnlen
_wcslwr
wcsstr
fflush
_wcmdln
_XcptFilter
memset

rpcrt4

UuidCreate

imagehlp

CheckSumMappedFile

ntdll

NtEnumerateBootEntries
NtQueryDirectoryObject
NtOpenDirectoryObject
NtTranslateFilePath
NtQueryBootOptions
NtQueryBootEntryOrder
NtQueryValueKey
NtQuerySymbolicLinkObject
NtOpenKey
NtOpenSymbolicLinkObject
RtlImpersonateSelf
NtOpenThreadTokenEx
NtOpenProcessTokenEx
NtAdjustPrivilegesToken
RtlFreeHeap
RtlAllocateHeap
NtSetInformationFile
LdrAccessResource
LdrFindResource_U
NtOpenFile
NtQueryInformationThread
NtQueryInformationFile
RtlImageNtHeader
NtDeviceIoControlFile
NtSetInformationThread
NtReadFile
NtOpenProcess
NtQueryInformationProcess
RtlNtStatusToDosError
NtClose
RtlInitUnicodeString
NtWriteFile
NtQuerySystemInformation
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCloseKey
RegQueryValueExW

api-ms-win-shcore-obsolete-l1-1-0

CommandLineToArgvW

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

OpenThreadToken
GetCurrentProcessId
OpenProcessToken
GetStartupInfoW
GetCurrentThread
TerminateProcess
GetCurrentProcess
GetCurrentThreadId

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
LoadLibraryExW
FreeLibrary
GetModuleHandleW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-file-l1-1-0

GetFileAttributesW
CreateFileW
GetVolumePathNameW
SetFileAttributesW
FindNextFileW
CreateDirectoryW
FindFirstFileW
GetVolumeInformationW
GetFileSizeEx
FlushFileBuffers
GetFileInformationByHandle
FindClose
SetFileInformationByHandle
WriteFile
DeleteFileW
GetFullPathNameW
GetLongPathNameW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-privateprofile-l1-1-0

GetPrivateProfileSectionW

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx
MoveFileExW
CopyFileExW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathRemoveBackslashW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-memory-l1-1-0

MapViewOfFile
UnmapViewOfFile
CreateFileMappingW

api-ms-win-security-base-l1-1-0

GetSecurityDescriptorDacl
GetTokenInformation
AdjustTokenPrivileges
GetSecurityDescriptorSacl
GetSecurityDescriptorControl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW

api-ms-win-security-provider-l1-1-0

SetNamedSecurityInfoW

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

076152a38ca83ca117b6fdb82409f937

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

rpcrt4

imagehlp

ntdll

api-ms-win-core-registry-l1-1-0

api-ms-win-shcore-obsolete-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-privateprofile-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-security-provider-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

Sections

.text Size: 48KB - Virtual size: 47KB

.rdata Size: 32KB - Virtual size: 30KB

.data Size: 4KB - Virtual size: 1KB

.pdata Size: 4KB - Virtual size: 1KB

.rsrc Size: 4KB - Virtual size: 2KB

.reloc Size: 4KB - Virtual size: 64B

.text
Size: 48KB - Virtual size: 47KB

.rdata
Size: 32KB - Virtual size: 30KB

.data
Size: 4KB - Virtual size: 1KB

.pdata
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 4KB - Virtual size: 2KB

.reloc
Size: 4KB - Virtual size: 64B