an[.]bmp_ | Triage

Resubmissions

06/11/2023, 14:47

231106-r54k2sbh2w 3

Sharing

Copy URL Twitter E-mail

General

Target

an.bmp_
Size

1.1MB
MD5

e2438b46e73b05437da02c650ba752b2
SHA1

707b688aa3db0f3b827bc707fe1d37b9bcb5f5eb
SHA256

2c476a1cce128d9a13e33f37be0e686cac74a8c3e2c50dfc502ee685c5bd2eb3
SHA512

299fac958ab2829ead79b90069e06fff5bfa4bf143dedb2640ff067f396b5eb73ecc4a708e561512c93c203e5f42400fabb9d46863a2973171f18d87ad75b12b
SSDEEP

12288:iDcGzF1ee353r9cs4LBsAJLckpIfodj153r9cs4LBsAJLckpIfodD0D7:iDFe6rk6ApXrk6Ai3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
an.bmp_

Files

an.bmp_
.exe windows:6 windows x86

2c9e6060ed6f2a0f7b31981e8de454fc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

AcquireSRWLockExclusive
AcquireSRWLockShared
Delete�riticalSection
Enter�riticalSection
FlsAlloc
FlsGetValue
FlsSetValue
Get�urrentProcess
GetLastError
GetModuleHandleW
GetProcAddress
GetStartupInfoA
GetSystemTimeAsFileTime
InitOnceExecuteOnce
Initialize�riticalSection
IsDB�SLeadByteEx
K32EnumProcessModules
Leave�riticalSection
MultiByteToWide�har
ReleaseSRWLockExclusive
ReleaseSRWLockShared
Rtl�apture�ontext
SetUnhandledExceptionFilter
Sleep
Sleep�onditionVaria`leSRW
TlsGetValue
VirtualProtect
VirtualQuery
WakeAll�onditionVaria`le
Wide�harToMultiByte

msvcrt

__getmainargs
__initenv
__m`_cur_max
__p__commode
__p__fmode
__set_app_type
__setusermatherr
_aligned_free
_aligned_malloc
_amsg_exit
_assert
_cexit
_errno
_initterm
_io`
_ism``lead
_lock
_onexit
_unlock
_wcslwr_s
a`ort
atoi
calloc
exit
fflush
fprintf
fputc
fputwc
free
e
fwrite
getenv
iswctype
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
rand
realloc
setlocale
signal
srand
strchr
strcmp
strlen
strncmp
time
vfprintf
wcscpy_s
wcslen

Sections

.text
Size: 269KB - Virtual size: 269KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rdata
Size: 371KB - Virtual size: 370KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: 94KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gcc_exc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 343KB - Virtual size: 343KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

2c9e6060ed6f2a0f7b31981e8de454fc

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

Sections

.text Size: 269KB - Virtual size: 269KB

.rdata Size: 371KB - Virtual size: 370KB

.data Size: 1024B - Virtual size: 4KB

.00cfg Size: 512B - Virtual size: 4B

.eh_fram Size: 94KB - Virtual size: 93KB

.gcc_exc Size: 2KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 8B

.rsrc Size: 343KB - Virtual size: 343KB

.reloc Size: 29KB - Virtual size: 29KB

.text
Size: 269KB - Virtual size: 269KB

.rdata
Size: 371KB - Virtual size: 370KB

.data
Size: 1024B - Virtual size: 4KB

.00cfg
Size: 512B - Virtual size: 4B

.eh_fram
Size: 94KB - Virtual size: 93KB

.gcc_exc
Size: 2KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 8B

.rsrc
Size: 343KB - Virtual size: 343KB

.reloc
Size: 29KB - Virtual size: 29KB