BBS41616_2024-03-14_13_28_18[.]628[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

BBS41616_2024-03-14_13_28_18.628.zip
Size

766KB
MD5

84e252a3819e58895a24e53e8663533e
SHA1

89c4e925e18eebd893cf9529e717acee8be0752c
SHA256

07431bc868ded5e51f3811ea5201628469a0c61496f3f3875bed100d34ac324f
SHA512

1112e2dc95493091925989d682502cc6b468cff896c105fc11ee63e2bd98bbc9c2c050b55cca016bb9d05aa68e0eb15b496f94b8aa057ceac01ee8296134cbfa
SSDEEP

12288:iILc0yIGN+SyWF6a48pdc5Ym+FPofo8rp6lmNA8aXHZP8+haEzEDYGAj3LMV:iwcDIJSyk68Pc5YmiN8rpAmmm3Ez2pM6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Device/HarddiskVolume3/WINDOWS/System32/pwNative.exe

Files

BBS41616_2024-03-14_13_28_18.628.zip
.zip

Password: Infected123!
Device/HarddiskVolume3/WINDOWS/System32/pwNative.exe
.sys windows:5 windows x64 arch:x64

5536aee61ff7d7e137ba037bcc7560ca

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

K:\MiniTool Partition Wizard -TFS\winnative-branch-v1023\x64\Native-Release\pwNative.pdb

Imports

ntdll

strcat
vsprintf
sprintf
strcpy
memset
_fltused
memcpy
strlen
__C_specific_handler
__chkstk
_strnicmp
NtCreateSymbolicLinkObject
NtClose
NtMakeTemporaryObject
swprintf
_wtoi
wcslen
wcsstr
NtQuerySymbolicLinkObject
NtOpenSymbolicLinkObject
RtlInitUnicodeString
NtInitializeRegistry
NtCreateFile
NtFlushKey
NtCreateKey
RtlNtStatusToDosError
NtLoadDriver
NtLockVirtualMemory
LdrQueryProcessModuleInformation
RtlLockHeap
NtSetInformationProcess
NtQueryInformationProcess
NtTerminateProcess
wcscpy
NtSaveKey
NtOpenKey
_wcsicmp
NtQuerySystemInformation
RtlCreateHeap
RtlDestroyHeap
RtlUnlockHeap
RtlAllocateHeap
RtlFreeHeap
RtlFreeUnicodeString
NtDisplayString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
NtCancelIoFile
NtWaitForMultipleObjects
NtReadFile
NtCreateEvent
RtlUnicodeToMultiByteN
RtlMultiByteToUnicodeN
RtlDosPathNameToNtPathName_U
NtWriteFile
NtSetInformationFile
NtQueryInformationFile
NtFlushBuffersFile
NtDeviceIoControlFile
NtFsControlFile
RtlInitializeCriticalSection
RtlEnterCriticalSection
RtlLeaveCriticalSection
RtlDeleteCriticalSection
NtQueryVolumeInformationFile
NtQuerySystemTime
RtlSystemTimeToLocalTime
RtlTimeFieldsToTime
RtlTimeToTimeFields
NtQueryAttributesFile
NtOpenFile
DbgPrint
wcstombs
RtlQueryEnvironmentVariable_U
NtDeleteFile
NtAllocateVirtualMemory
NtFreeVirtualMemory
NtSetValueKey
NtDeleteValueKey
NtQueryValueKey
NtEnumerateKey
NtAdjustPrivilegesToken
NtQueryInformationToken
NtOpenProcessToken
NtLoadKey2
NtUnloadKey
mbstowcs
memcmp
_memicmp
strstr
strcmp
_stricmp
_strupr
atol
_wtol
_wcsnicmp
strncpy
memmove
_strlwr
NtQueryDirectoryObject
NtOpenDirectoryObject
_atoi64
strchr
_ultoa
_i64toa
NtShutdownSystem
NtSetSystemPowerState

Exports

Exports

?kCreateMutex@@YAPEAXXZ
?kLockMutex@@YAXPEAX@Z
?kUnlockMutex@@YAXPEAX@Z

Sections

.text
Size: 971KB - Virtual size: 970KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 155B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
manifest.json

Sharing

General

Malware Config

Signatures

Files

Password: Infected123!

5536aee61ff7d7e137ba037bcc7560ca

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

Exports

Exports

Sections

.text Size: 971KB - Virtual size: 970KB

.rdata Size: 78KB - Virtual size: 78KB

.data Size: 2.3MB - Virtual size: 2.3MB

.pdata Size: 39KB - Virtual size: 39KB

.edata Size: 512B - Virtual size: 155B

.xdata Size: 28KB - Virtual size: 27KB

.reloc Size: 11KB - Virtual size: 10KB

.text
Size: 971KB - Virtual size: 970KB

.rdata
Size: 78KB - Virtual size: 78KB

.data
Size: 2.3MB - Virtual size: 2.3MB

.pdata
Size: 39KB - Virtual size: 39KB

.edata
Size: 512B - Virtual size: 155B

.xdata
Size: 28KB - Virtual size: 27KB

.reloc
Size: 11KB - Virtual size: 10KB