b9b402c2adb4c9d68980eb2c6781fe6b

Sharing

Copy URL

Twitter E-mail

General

Target

b9b402c2adb4c9d68980eb2c6781fe6b
Size

28KB
MD5

b9b402c2adb4c9d68980eb2c6781fe6b
SHA1

996c2e02659b32eb39bb5832d494187213b87d7e
SHA256

6fab8a09476689b7569174ed964bbc3dfab49858fbb47c782a0c8952e0be762c
SHA512

1ef608ec31c9ae1ff36909aabc86570c8348d23ed778ee36bdfc14b9e6f9cea4db89a03cbbac56eac7a8689336f7ebd319f434c7fdc5f4d7bb375dda72f07d38
SSDEEP

384:NHnK8OzJi5npuPsGHBsy3oOGJwdWmdjmqMo2oaU9yeW455VWMSA6Y7:NHeJenpuXHBsykJwdWm8do2ZU9ye5i4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b9b402c2adb4c9d68980eb2c6781fe6b

Files

b9b402c2adb4c9d68980eb2c6781fe6b
.exe windows:5 windows x86 arch:x86

13777c0124fcb9f52551f811fbf9988a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

bthci.pdb

Imports

msvcrt

_except_handler3
??3@YAXPAX@Z
malloc
??2@YAPAXI@Z
_vsnwprintf

ntdll

VerSetConditionMask

setupapi

SetupCloseLog
SetupLogErrorW
SetupDiInstallDevice
SetupDiCreateDevRegKeyW
SetupDiGetDeviceRegistryPropertyW
SetupDiOpenDevRegKey
SetupDiSetClassInstallParamsW
SetupDiGetClassInstallParamsW
SetupOpenLog

user32

CharNextW
GetCapture
GetInputState
GetActiveWindow
SetWindowTextW
LoadStringW
SendMessageW
EnableWindow
GetFocus
DialogBoxParamW
SetWindowLongW
GetWindowLongW
GetCursor

advapi32

StartServiceW
ChangeServiceConfigW
QueryServiceConfigW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
RegOpenKeyExW
RegDeleteValueW
RegCreateKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegSetKeySecurity
RegCloseKey
RegQueryValueExW
RegSetValueExW
CreateServiceW

kernel32

LoadLibraryA
QueryPerformanceCounter
GetProcessHeap
VirtualAlloc
GetCurrentThreadId
GlobalAlloc
GetVersion
GetLastError
GetCurrentProcessId
FreeEnvironmentStringsA
GetModuleHandleA
GetCurrentProcess
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetProcAddress
GetModuleHandleW
lstrcpynW
GetConsoleOutputCP
LoadLibraryW
MultiByteToWideChar
GetStartupInfoA
GetOEMCP
IsSystemResumeAutomatic
LocalFree
GetLogicalDrives
GetUserDefaultLCID
SetLastError
IsDebuggerPresent
WideCharToMultiByte
lstrcmpiW
InterlockedDecrement
LocalAlloc

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

13777c0124fcb9f52551f811fbf9988a

Headers

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

setupapi

user32

advapi32

kernel32

Sections

.text Size: 12KB - Virtual size: 12KB

.data Size: 8KB - Virtual size: 8KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 12KB - Virtual size: 12KB

.data
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 2KB - Virtual size: 2KB