Static task
static1
Behavioral task
behavioral1
Sample
bws-jbbs.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
bws-jbbs.exe
Resource
win10v2004-20230915-en
General
-
Target
bws-jbbs.exe
-
Size
406KB
-
MD5
2c1835b391a7eef0091fd1dbb18f5e79
-
SHA1
a45b7f838b7a698d3a9f35fbcfc95aabacad741f
-
SHA256
6884164631a0dcdabc33ed961dacaa9bcd9ba144d1e8a4ca9a3378d8fb806fdd
-
SHA512
ea7e5c7387ff907753ab12f687d9990c1e8e2137041b9b5627a8678bba61ecf39ed37c2a6b7a57086087fa2019dbfcb0e0c2611f4c6835e48a86850d767d49d2
-
SSDEEP
1536:usFLhw/wAzgPeFQzqwKtd1ENU7SCKP8WKKKvlaCL7gjZu40CRrHlxyC7/b5mf+RE:usF3PeiiZnDEjH5mWRw7fR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bws-jbbs.exe
Files
-
bws-jbbs.exe.exe windows:4 windows x86
6f612ff9df75a349bf75e1e790da9199
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
ExitProcess
GetWindowsDirectoryA
lstrcatA
CreateDirectoryA
DeleteFileA
RemoveDirectoryA
FindResourceA
LoadResource
LockResource
SizeofResource
CreateFileA
WriteFile
CloseHandle
OpenProcess
VirtualAllocEx
WriteProcessMemory
LoadLibraryA
GetProcAddress
CreateRemoteThread
WaitForSingleObject
CreateThread
SetThreadPriority
HeapAlloc
HeapCreate
HeapDestroy
Sleep
ReadFile
SetFilePointer
user32
DialogBoxParamA
SetTimer
LoadBitmapA
SendDlgItemMessageA
FindWindowA
EndDialog
GetWindowThreadProcessId
GetDlgItem
SendMessageA
RegisterHotKey
ReleaseCapture
gdi32
CreateFontA
SetBkMode
SetTextColor
SetBkColor
CreateSolidBrush
GetStockObject
winmm
waveOutClose
waveOutGetPosition
waveOutOpen
waveOutPrepareHeader
waveOutReset
waveOutUnprepareHeader
waveOutWrite
Sections
code Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
data Size: 8KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 387KB - Virtual size: 386KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ