2ae853f0b83d3dffeaf192cb3e64209ad52bbfd5f0c41f85f1e1cea7217e3dc4 | Triage

Resubmissions

07-05-2024 12:38

240507-pvdkrsga4z 10

16-10-2023 16:11

231016-tmwtlaab41 7

Sharing

General

Target

2ae853f0b83d3dffeaf192cb3e64209ad52bbfd5f0c41f85f1e1cea7217e3dc4
Size

1.1MB
MD5

e8edf6671952bf5eb4bfefd587ce565f
SHA1

304254da810f4a1d1ce4377c7e71b3c3d5f2ce4e
SHA256

2ae853f0b83d3dffeaf192cb3e64209ad52bbfd5f0c41f85f1e1cea7217e3dc4
SHA512

1bbd29839d35f78594d74097b46379fe4812c238ea65760301b01454b32e3600f68901bef18b495047d48d3301d77767395d71feb150848882aa97aa42730189
SSDEEP

24576:8AzEz9lPbnRQbenR3QzJwTIadRFD3YPKzJ7vFAjP/FrcBb/rq+T:8h5RLTBQNwTIalYPO9F8P/FmbzqK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Birdman/Birdman.dll

Files

2ae853f0b83d3dffeaf192cb3e64209ad52bbfd5f0c41f85f1e1cea7217e3dc4
.zip
Birdman/8lN0/YR9.md
Birdman/Birdman.dll
.dll windows:6 windows x86

244d8f9f2c625c07accc7836974657c1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetProcessHeap
CloseHandle
GetComputerNameA
GetLastError
HeapWalk
HeapCreate
TryEnterCriticalSection
CreateActCtxA
ActivateActCtx
CreateThread
GetCurrentProcessId
WaitForSingleObject
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
VirtualAlloc
HeapLock

Exports

Exports

DeR8
HUF_inc_var
ITbi4
ObrRM2679
OdAgP61
YiRgp93sN0

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 787KB - Virtual size: 787KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Birdman/TZZ.pdf.lnk
.lnk