C:\Users\PC\Documents\Visual Studio 2015\Projects\Bonzify\Release\Bonzify.pdb
Static task
static1
Behavioral task
behavioral1
Sample
Bonzify.exe
Resource
win7-20240221-en
General
-
Target
Bonzify.bin.zip
-
Size
5.6MB
-
MD5
c74a814bf73916f260c9ead93cbc25d8
-
SHA1
c30c813e2d7a8b0b07737578e526c531c4618b88
-
SHA256
a88067e092dbd0f7ce36eabdb7ab97d37e125962d30eb1b9ef48caa17333fd7e
-
SHA512
7fd5a30bca5178953d538e38fd081c5c28920d89a7768084c4c815a036bbe6adb0d88543bce725355f2f6cbadec09c4caf45eb6c8361365503c82ea104327e82
-
SSDEEP
98304:IFECoItQwcAPOy+uPo7b0beVCYwCEkH4B+aCPEojqfCu5Sb5biEfV2N2smW9uB:AWzAUuPLCpnYUPEQu5Sb5+Ef22z3B
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/Bonzify.bin
Files
-
Bonzify.bin.zip.zip
Password: infected
-
Bonzify.bin.exe windows:5 windows x86 arch:x86
0bee32f8779ce7af7a869e923f1dd6fb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
FindClose
lstrcmpA
lstrcatA
CreateFileA
lstrcpyA
CloseHandle
LocalFree
GetProcessHeap
FlushFileBuffers
Sleep
DeleteFileA
CreateThread
HeapAlloc
SizeofResource
lstrlenA
SetLastError
TerminateProcess
ExpandEnvironmentStringsA
GetFullPathNameA
FindResourceA
WaitForSingleObject
OpenProcess
CreateToolhelp32Snapshot
LockResource
Process32Next
LoadResource
lstrcmpiA
CreateProcessA
FindNextFileA
WriteFile
HeapFree
FindFirstFileA
Process32First
LocalAlloc
user32
SendMessageA
advapi32
RegOpenKeyA
RegSetValueExA
RegCloseKey
shell32
SHCreateDirectoryExA
SHChangeNotify
ole32
CoInitialize
CoCreateInstance
oleaut32
SysAllocString
SysFreeString
shlwapi
PathRemoveFileSpecA
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6.4MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 452B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ