bf4[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

bf4.exe
Size

17.4MB
MD5

ded83cb9bb9334f1442a0099096632c9
SHA1

a32e1b7c5a72efad842d0a4d1edb0d8435ebc848
SHA256

47579603f29f74bf9fc676df0e7e12202831d0610c2b9594eb3fd5633a64998f
SHA512

b525872d2838341a98df24181a58ae2c3c82569ea16fd0d1e755585cd06ad73e501d6ea407b102236e46013f0c32e61e78cd4460f5ef9bd8afbba7e5797d4c49
SSDEEP

393216:r/3NnU+oBtFv4Nk/H1fWifHcIWL+gHn1+eGYwLpwCksXBM7FT:L3NnyCS1fLfH7WLPnJCq2M7FT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bf4.exe

Files

bf4.exe
.exe windows:6 windows x64 arch:x64

2e6f030b9b7aaa6dbf18aa69fe4d8465

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegQueryValueExW

dinput8

DirectInput8Create

dsound

DirectSoundCaptureEnumerateW

gdi32

SelectObject

iphlpapi

IcmpSendEcho

kernel32

GetVersionExA
GetCurrentDirectoryW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

msvcp110

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ

msvcr110

_exit

oleaut32

VariantInit

psapi

GetModuleInformation

shell32

ShellExecuteA

user32

ShowWindow

usp10

ScriptItemize

winmm

waveInUnprepareHeader

ws2_32

setsockopt

wtsapi32

WTSRegisterSessionNotification

xinput9_1_0

XInputGetCapabilities

bcrypt

BCryptCloseAlgorithmProvider

d3d11

D3D11CreateDevice

dbghelp

SymFunctionTableAccess

dwmapi

DwmEnableComposition

dxgi

CreateDXGIFactory1

ole32

PropVariantClear

urlmon

URLOpenBlockingStreamA

Exports

Exports

IsGameRuntime
ProcessLocFile
RegisterLabels
RegisterLanguage
RegisterLargest
SetPlatform
opus_decode
opus_decode_float
opus_decoder_create
opus_decoder_ctl
opus_decoder_destroy
opus_decoder_get_nb_samples
opus_decoder_get_size
opus_decoder_init
opus_encode
opus_encode_float
opus_encoder_create
opus_encoder_ctl
opus_encoder_destroy
opus_encoder_get_size
opus_encoder_init
opus_get_version_string
opus_packet_get_bandwidth
opus_packet_get_nb_channels
opus_packet_get_nb_frames
opus_packet_get_nb_samples
opus_packet_get_samples_per_frame
opus_packet_parse
opus_repacketizer_cat
opus_repacketizer_create
opus_repacketizer_destroy
opus_repacketizer_get_nb_frames
opus_repacketizer_get_size
opus_repacketizer_init
opus_repacketizer_out
opus_repacketizer_out_range
opus_strerror

Sections

.text
Size: - Virtual size: 24.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

ctr
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 7.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: - Virtual size: 4.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

typeinfo
Size: - Virtual size: 920KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

fieldinf
Size: - Virtual size: 468KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.3DMGAME
Size: - Virtual size: 196KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SCY
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.3DMGAME
Size: - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.3DMGAME
Size: 17.2MB - Virtual size: 17.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 186KB - Virtual size: 186KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2e6f030b9b7aaa6dbf18aa69fe4d8465

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

dinput8

dsound

gdi32

iphlpapi

kernel32

msvcp110

msvcr110

oleaut32

psapi

shell32

user32

usp10

winmm

ws2_32

wtsapi32

xinput9_1_0

bcrypt

d3d11

dbghelp

dwmapi

dxgi

ole32

urlmon

Exports

Exports

Sections

.text Size: - Virtual size: 24.3MB

ctr Size: - Virtual size: 1.3MB

.rdata Size: - Virtual size: 7.2MB

.data Size: - Virtual size: 4.9MB

.pdata Size: - Virtual size: 1.4MB

typeinfo Size: - Virtual size: 920KB

fieldinf Size: - Virtual size: 468KB

.tls Size: - Virtual size: 4KB

.rodata Size: - Virtual size: 4KB

_RDATA Size: - Virtual size: 20KB

.3DMGAME Size: - Virtual size: 196KB

.SCY Size: - Virtual size: 20KB

.3DMGAME Size: - Virtual size: 2.9MB

.3DMGAME Size: 17.2MB - Virtual size: 17.2MB

.rsrc Size: 186KB - Virtual size: 186KB

.text
Size: - Virtual size: 24.3MB

ctr
Size: - Virtual size: 1.3MB

.rdata
Size: - Virtual size: 7.2MB

.data
Size: - Virtual size: 4.9MB

.pdata
Size: - Virtual size: 1.4MB

typeinfo
Size: - Virtual size: 920KB

fieldinf
Size: - Virtual size: 468KB

.tls
Size: - Virtual size: 4KB

.rodata
Size: - Virtual size: 4KB

_RDATA
Size: - Virtual size: 20KB

.3DMGAME
Size: - Virtual size: 196KB

.SCY
Size: - Virtual size: 20KB

.3DMGAME
Size: - Virtual size: 2.9MB

.3DMGAME
Size: 17.2MB - Virtual size: 17.2MB

.rsrc
Size: 186KB - Virtual size: 186KB