batnik[.]bat | Triage

Sharing

Copy URL Twitter E-mail

General

Target

batnik.bat
Size

36KB
MD5

f2b2f2bfbe37317093236dfc7331e777
SHA1

9ab076d5d1a26ed9303adf13584de956d28df96a
SHA256

dc23fa13a71e64ca76eb48c019b63576b35bb3da63ebd7a316f56f8591072dd0
SHA512

e25ee0ea7544d0f1f9008014caa59ecb350758eda1341ecf80787293e2c54c63c21a6e5ee9c552174872b1cd00c1dc94bfa3c4bb20ad67fb1d47d9e0e2354bff
SSDEEP

768:uNnmZ/8vPlLUdhfJ8v6utFpVsuRregrWChgztxb7Dsr1:Anwu4DejVLyOhgz3Yr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
batnik.bat

Files

batnik.bat
.exe windows:4 windows x86 arch:x86

d01b793cfeabb1210a9dfd924e5cbf0d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

user32

SendInput

gdi32

DeleteDC

advapi32

RegCloseKey

shell32

ExtractIconA

msvcp60

??0_Winit@std@@QAE@XZ

msvcrt

_iob

winmm

waveInOpen

shlwapi

PathFileExistsA

ws2_32

htons

urlmon

URLDownloadToFileA

gdiplus

GdipFree

wininet

InternetOpenA

Sections

.MPRESS1
Size: 28KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE