@Wanna.BuddyMemes.win.zip
- SHA256 1cb1619eb5345a3d8d6aca8a8d221b523aadb3c59ae4778d4d471b22503caa5c
Password
NoEscapeCry
Overview
overview
8Static
static
3@Wanna.Bud...in.zip
windows7-x64
1@Wanna.Bud...in.zip
windows10-1703-x64
1@Wanna.Bud...in.zip
windows10-2004-x64
1@Wanna.Bud...in.zip
windows11-21h2-x64
1Bonzify.exe
windows7-x64
8Bonzify.exe
windows10-1703-x64
8Bonzify.exe
windows10-2004-x64
8Bonzify.exe
windows11-21h2-x64
8LOVE-LETTE...XT.vbs
windows7-x64
1LOVE-LETTE...XT.vbs
windows10-1703-x64
1LOVE-LETTE...XT.vbs
windows10-2004-x64
1LOVE-LETTE...XT.vbs
windows11-21h2-x64
1MEMZ.exe
windows7-x64
6MEMZ.exe
windows10-1703-x64
7MEMZ.exe
windows10-2004-x64
7MEMZ.exe
windows11-21h2-x64
6salinewin.exe
windows7-x64
8salinewin.exe
windows10-1703-x64
8salinewin.exe
windows10-2004-x64
8salinewin.exe
windows11-21h2-x64
8Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
@Wanna.BuddyMemes.win.zip
Resource
win7-20240215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
@Wanna.BuddyMemes.win.zip
Resource
win10-20240221-en
windows10-1703-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
@Wanna.BuddyMemes.win.zip
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
@Wanna.BuddyMemes.win.zip
Resource
win11-20240221-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Bonzify.exe
Resource
win7-20231129-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral6
Sample
Bonzify.exe
Resource
win10-20240221-en
windows10-1703-x64
17 signatures
150 seconds
Behavioral task
behavioral7
Sample
Bonzify.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral8
Sample
Bonzify.exe
Resource
win11-20240221-en
windows11-21h2-x64
24 signatures
150 seconds
Behavioral task
behavioral9
Sample
LOVE-LETTER-FOR-YOU.TXT.vbs
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
LOVE-LETTER-FOR-YOU.TXT.vbs
Resource
win10-20240221-en
windows10-1703-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
LOVE-LETTER-FOR-YOU.TXT.vbs
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
LOVE-LETTER-FOR-YOU.TXT.vbs
Resource
win11-20240221-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
MEMZ.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral14
Sample
MEMZ.exe
Resource
win10-20240221-en
windows10-1703-x64
11 signatures
150 seconds
Behavioral task
behavioral15
Sample
MEMZ.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral16
Sample
MEMZ.exe
Resource
win11-20240221-en
windows11-21h2-x64
8 signatures
150 seconds
Behavioral task
behavioral17
Sample
salinewin.exe
Resource
win7-20240215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral18
Sample
salinewin.exe
Resource
win10-20240221-en
windows10-1703-x64
4 signatures
150 seconds
Behavioral task
behavioral19
Sample
salinewin.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral20
Sample
salinewin.exe
Resource
win11-20240214-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target @Wanna.BuddyMemes.win.zip
- Size 5.7MB
- Sample240309-vszm4sda87
- SHA256 1cb1619eb5345a3d8d6aca8a8d221b523aadb3c59ae4778d4d471b22503caa5c
- MD5 0e9a9f123c060ba25b0a940293bbd43a
- SHA1 6a4f0a5f67227c4aa8cfcdbb58c442e399b528e3
- SHA512 bf1beb6fd44dd8d0cc7743951fdac09eaa0408cf6e2984ac73347cc0900eeb142f908546b7e3a1ae5ac4680224ae37881e582d98eac3ade730e6610587b47022
- SSDEEP 98304:RC00b49gKZlvW/erCw1WooPemkiO6jR1DGji0VwoEpe3UxBH772Xg:RC00b49JZlvW/ed1WooWt0JiwoE43UXJ
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Bonzify.exe unpack001/MEMZ.exe unpack001/salinewin.exe
File Explorer
-
@Wanna.BuddyMemes.win.zip.zip 5.7MB
-
Bonzify.exe.exe 6.4MB
-
LOVE-LETTER-FOR-YOU.TXT.vbs.vbs 14KB
-
MEMZ.exe.exe 16KB
-
salinewin.exe.exe 283KB
Bonzify.exe
- IMPHASH 0bee32f8779ce7af7a869e923f1dd6fb
- SHA256 66f62408dfce7c4a5718d2759f1d35721ca22077398850277d16e1fca87fe764
- MD5 fba93d8d029e85e0cde3759b7903cee2
- SHA1 525b1aa549188f4565c75ab69e51f927204ca384
- SHA512 7c1441b2e804e925eb5a03e97db620117d3ad4f6981dc020e4e7df4bfc4bd6e414fa3b0ce764481a2cef07eebb2baa87407355bfbe88fab96397d82bd441e6a2
- SSDEEP 196608:adAMaWetTeAkLIdx751qFTkub//73lc6u7b5VJ2Yx5xIdk3:OaWedh+Idx75QYub//73lc6u7bLMYxD
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
NoEscapeCry
Minor OS version
1
Major OS version
5
Entry point
5808
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
FindClose
lstrcmpA
lstrcatA
CreateFileA
lstrcpyA
CloseHandle
LocalFree
GetProcessHeap
FlushFileBuffers
Sleep
DeleteFileA
CreateThread
HeapAlloc
SizeofResource
lstrlenA
SetLastError
TerminateProcess
ExpandEnvironmentStringsA
GetFullPathNameA
FindResourceA
WaitForSingleObject
OpenProcess
CreateToolhelp32Snapshot
LockResource
Process32Next
LoadResource
lstrcmpiA
CreateProcessA
FindNextFileA
WriteFile
HeapFree
FindFirstFileA
Process32First
LocalAlloc
user32
SendMessageA
advapi32
RegOpenKeyA
RegSetValueExA
RegCloseKey
shell32
SHCreateDirectoryExA
SHChangeNotify
ole32
CoInitialize
CoCreateInstance
oleaut32
SysAllocString
SysFreeString
shlwapi
PathRemoveFileSpecA
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6.4MB
Virtual Size
6.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
452B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=48, id=1, productName=Unmarked objects,
count=4, id=265, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
LOVE-LETTER-FOR-YOU.TXT.vbs
- SHA256 b6dc96d48ee73fda299a8f8dac2335ed4bf710f5166ce093aa8734256a205569
- MD5 48ac397b96a30da6d67ffcf5b555e69c
- SHA1 6b509435d7ab375d40231081417a340910da513c
- SHA512 4dd6ca7a18b7dceac16a8cec892f658a2389efe3b6a936ac9bf26f20a99a7a65d76dec1a412988e9a5be59276a7f7c0bca08583a474c8a9609799a4bab4ed5f2
- SSDEEP 384:U8kvaf1TYIe6lrsRjcOe/qEVqyK6hNj68BYqhYRLyfwjNOVjVA:U8f18Ie2rsmj68uYji5
- MD5 SHA1 SHA512 SSDEEP
MEMZ.exe
- IMPHASH 2eb516ca11536a75b455bb2361a5a574
- SHA256 3872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff
- MD5 1d5ad9c8d3fee874d0feb8bfac220a11
- SHA1 ca6d3f7e6c784155f664a9179ca64e4034df9595
- SHA512 c8246f4137416be33b6d1ac89f2428b7c44d9376ac8489a9fbf65ef128a6c53fb50479e1e400c8e201c8611992ab1d6c1bd3d6cece89013edb4d35cdd22305b1
- SSDEEP 192:M2WgyvSW8gRc6olcIEiwqZKBkDFR43xWTM3LHf26gFrcx3sNq:JWgnSmFlcIqq3agmLH+6gF23sN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
NoEscapeCry
Minor OS version
1
Major OS version
5
Entry point
4653
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
WriteFile
CloseHandle
lstrcmpA
lstrcmpW
LoadLibraryA
GetModuleFileNameW
GetCommandLineW
CreateFileA
Sleep
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GlobalAlloc
GlobalFree
GetModuleHandleW
lstrlenW
GetCurrentThreadId
CreateThread
ExitProcess
GetCurrentProcess
OpenProcess
LocalFree
LocalAlloc
SetPriorityClass
GetProcAddress
user32
MessageBoxW
SetCursorPos
GetCursorPos
GetDesktopWindow
EnumChildWindows
CallNextHookEx
LoadIconW
GetWindowRect
SetWindowsHookExW
MessageBoxA
CreateWindowExA
RegisterClassExA
DefWindowProcW
ExitWindowsEx
DispatchMessageW
TranslateMessage
GetWindowDC
DrawIcon
GetSystemMetrics
SendMessageTimeoutW
SendInput
GetMessageW
UnhookWindowsHookEx
gdi32
BitBlt
StretchBlt
advapi32
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
CryptAcquireContextW
CryptGenRandom
shell32
CommandLineToArgvW
ShellExecuteW
ShellExecuteA
ShellExecuteExW
winmm
waveOutWrite
PlaySoundA
waveOutPrepareHeader
waveOutOpen
psapi
GetProcessImageFileNameA
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
624B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
528B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=64, id=1, productName=Unmarked objects,
count=5, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
salinewin.exe
- IMPHASH c9b441367974f8bcdb3c75cfd640f1a7
- SHA256 7163fefbf2f865ef78a2d3d4480532fffb979300d6f0a77b6f3fc5c4b0d2cada
- MD5 2b1e9226d7e1015552a21faca891ec41
- SHA1 f87fcbe10fa9312048214d4473498ad4f9f331ce
- SHA512 1852f6d05c9fca962178bc190bc8c90f0ca54ea99714480690f44417e49eee6c392579091ae8a6cd053ec47ad1980dbbbc0db3e0e00520ee1bdbadbf8dc9d69e
- SSDEEP 3072:HZVUJ58IAelkapH3shY6iEwgaBZP5pHQpYR95WPNpNMl3:nUJ5PzB5ZPPHQpY35WPNpGl3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
NoEscapeCry
Minor OS version
1
Major OS version
5
Entry point
13314
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\ACER\source\repos\salinewin\Release\salinewin.pdb
kernel32
DecodePointer
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapReAlloc
HeapSize
GetProcessHeap
GetStringTypeW
GetFileType
ExitProcess
GetProcAddress
CreateThread
LoadLibraryW
CloseHandle
TerminateThread
Sleep
CreateFileW
WriteFile
FlushFileBuffers
SetStdHandle
LCMapStringW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetACP
HeapFree
HeapAlloc
WaitForSingleObject
GetExitCodeProcess
CreateProcessA
GetFileAttributesExW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
CompareStringW
RaiseException
user32
GetCursorPos
ReleaseDC
SetCursorPos
InvalidateRect
GetDesktopWindow
SendMessageTimeoutW
GetDC
MessageBoxW
EnumChildWindows
GetSystemMetrics
DrawIcon
LoadIconW
gdi32
SelectObject
CreateDIBSection
CreateCompatibleDC
PolyBezier
DeleteDC
CreatePen
Ellipse
DeleteObject
CreateSolidBrush
BitBlt
winmm
waveOutOpen
waveOutClose
waveOutUnprepareHeader
waveOutWrite
waveOutPrepareHeader
Name
.text
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
58KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
172B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
159KB
Virtual Size
159KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=241, version=40116,
count=131, id=243, version=40116,
count=25, id=242, version=40116,
count=17, id=259, version=24237,
count=29, id=261, version=24237,
count=18, id=260, version=24237,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=120, id=1, productName=Unmarked objects,
count=1, id=265, version=24245,
count=1, id=255, version=24245,
count=1, id=151,
count=1, id=258, version=24245,