Static task
static1
Behavioral task
behavioral1
Sample
BB.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
BB.exe
Resource
win10v2004-20240221-en
General
-
Target
BB.exe
-
Size
305KB
-
MD5
5511c74b4d4776519a351e062acd6a15
-
SHA1
af93e08a09d97ceb1717b783d2457681433f38ce
-
SHA256
96f3aee2040c2075440dcce39c16f90ea9f5649061a86f51fb9c5baff4c5333d
-
SHA512
eb647682e825eda639d628ea1471b0af2451c78e7719308c57c97d8e916f2af09ed03612b2372704be40d59ba3cd2d8a60b0df4d78a258cfef10696ff4994064
-
SSDEEP
6144:WOgdivlT5Rt+npv/0bs8z9dk/Qj0UP8EohrYIx/:XlIntaDllPNoRp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource BB.exe
Files
-
BB.exe.exe windows:6 windows x64 arch:x64
09646d7676a6f7a47bea24466b8d22e7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CreateFileA
CreateProcessA
GetComputerNameA
TerminateProcess
GetLastError
LoadLibraryA
GetProcAddress
GetCurrentProcessId
WriteConsoleW
GetDriveTypeA
DeviceIoControl
GetCurrentProcess
OpenProcess
GetLogicalDrives
CloseHandle
WaitForSingleObjectEx
Sleep
SwitchToThread
GetCurrentThreadId
GetExitCodeThread
GetNativeSystemInfo
MultiByteToWideChar
LocalFree
FormatMessageA
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetEndOfFile
SetFileAttributesW
SetFilePointerEx
AreFileApisANSI
MoveFileExW
GetFileInformationByHandleEx
WideCharToMultiByte
QueryPerformanceCounter
QueryPerformanceFrequency
GetStringTypeW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
GetSystemTimeAsFileTime
GetModuleHandleW
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ReadFile
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetCommandLineA
GetCommandLineW
GetConsoleMode
ReadConsoleW
GetFileType
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleOutputCP
GetFileSizeEx
FlushFileBuffers
HeapReAlloc
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetProcessHeap
HeapSize
RtlUnwind
advapi32
AdjustTokenPrivileges
PrivilegeCheck
OpenProcessToken
LookupPrivilegeValueW
Sections
.text Size: 200KB - Virtual size: 199KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 83KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ