bCa5uXnragiG[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

bCa5uXnragiG.exe
Size

6.8MB
MD5

cb294eddb8966ea50649178d3af3f92a
SHA1

2dad3b8db7389036f2647fe7fb38854429dea83c
SHA256

cb30c82571d1082bdb5f8afab543fc6ea625118562cc2d38eca27f917d7071a8
SHA512

3401aef2989c484a0413c4c15afade1da05c5424fd13e0b576f19f97b4e74532900aebe699258eab6ccb20b72ce4c8735f6f5efd43461e11b8ff2aaba9a6d479
SSDEEP

196608:Z3qD1hus3Ajd0szh1hHypH/729ensfbQ3:Zihojd0s9a+2sfs3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bCa5uXnragiG.exe

Files

bCa5uXnragiG.exe
.exe windows:6 windows x64 arch:x64

5e2a014816675b22eb6b91f64ea63d4b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

H:\multiloader\bin\Release\inj.pdb

Imports

kernel32

SetPriorityClass
GetCurrentProcess
GetShortPathNameW
TerminateProcess
SetThreadPriority
GetEnvironmentVariableW
OpenProcess
MultiByteToWideChar
GetCurrentThread
lstrcatW
lstrcpyW
DeleteFileW
GetFileAttributesW
FindClose
RtlUnwind
SystemTimeToFileTime
GetSystemTime
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
DeleteFiber
SwitchToFiber
ReadConsoleA
SetConsoleMode
GetTempPathW
FindNextFileW
FindFirstFileW
GetProcAddress
LoadLibraryA
GetModuleHandleA
RtlAddFunctionTable
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CreateFileA
WriteConsoleW
HeapSize
SetEndOfFile
SetStdHandle
VirtualAlloc
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
HeapReAlloc
SetConsoleCtrlHandler
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
HeapFree
HeapAlloc
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetDriveTypeW
GetFileType
ReadFile
WriteFile
GetStdHandle
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
VirtualProtect
CloseHandle
WideCharToMultiByte
GetUserDefaultLocaleName
CopyFileW
Sleep
SetFileAttributesW
GetModuleFileNameW
GetCommandLineW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
GetCurrentThreadId
WaitForSingleObjectEx
GetExitCodeThread
FormatMessageA
LocalFree
GetLocaleInfoEx
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
FindFirstFileExW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
AreFileApisANSI
GetLastError
GetModuleHandleW
MoveFileExW
GetFileInformationByHandleEx
QueryPerformanceCounter
QueryPerformanceFrequency
WakeAllConditionVariable
SleepConditionVariableSRW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetSystemTimeAsFileTime
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
VerSetConditionMask
VerifyVersionInfoW
GlobalLock
GlobalUnlock
GlobalAlloc
GlobalFree
GetWindowsDirectoryW
SleepEx
GetSystemDirectoryW
FreeLibrary
LoadLibraryW
GetTickCount
CompareFileTime
GetEnvironmentVariableA
SetLastError
FormatMessageW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc

user32

CreateWindowExW
SendMessageTimeoutW
GetWindowRect
GetWindowThreadProcessId
SetWindowPos
SetClipboardData
EmptyClipboard
CloseClipboard
GetClipboardData
OpenClipboard
SystemParametersInfoW
ReleaseCapture
MapVirtualKeyW
SetCapture
GetCapture
ShowWindow
GetDC
MonitorFromWindow
ScreenToClient
GetCursorPos
SetCursorPos
ClientToScreen
GetKeyState
GetClientRect
SetCursor
FindWindowW
LoadImageW
UpdateWindow
GetUserObjectInformationW
GetProcessWindowStation
SetProcessDPIAware
GetDesktopWindow
SetWindowLongW
LoadCursorW
UnregisterClassW
TranslateMessage
DispatchMessageW
PostQuitMessage
PeekMessageW
RegisterClassW
ReleaseDC
PostMessageW
DefWindowProcW
MessageBoxA
MessageBoxW
SetLayeredWindowAttributes

shell32

SHChangeNotify
ShellExecuteExW
ShellExecuteA
ShellExecuteW
CommandLineToArgvW

ole32

CoCreateInstance
CoInitialize
CoUninitialize

d3d9

Direct3DCreate9

d3dx9_43

D3DXCreateTextureFromFileInMemoryEx
D3DXMatrixTranspose

ws2_32

send
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
closesocket
WSAGetLastError
recv
bind
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
socket
WSASetLastError
WSAIoctl
inet_pton
WSAStartup
WSACleanup
__WSAFDIsSet
select
accept
htonl
getnameinfo
listen
getaddrinfo
freeaddrinfo
ioctlsocket
gethostname
shutdown

crypt32

CertCloseStore
CertGetEnhancedKeyUsage
CertEnumCertificatesInStore
CertFreeCertificateContext
CertOpenSystemStoreW
CertGetIntendedKeyUsage

imm32

ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext

gdi32

GetDeviceCaps

advapi32

ReportEventW
DeregisterEventSource
RegCloseKey
RegEnumValueW
RegQueryInfoKeyW
RegOpenKeyExW
RegisterEventSourceW

bcrypt

BCryptGenRandom

Sections

.text
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 900KB - Virtual size: 900KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.3MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 117KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 103KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5e2a014816675b22eb6b91f64ea63d4b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

shell32

ole32

d3d9

d3dx9_43

ws2_32

crypt32

imm32

gdi32

advapi32

bcrypt

Sections

.text Size: 3.3MB - Virtual size: 3.3MB

.rdata Size: 900KB - Virtual size: 900KB

.data Size: 2.3MB - Virtual size: 2.4MB

.pdata Size: 117KB - Virtual size: 117KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 103KB - Virtual size: 102KB

.reloc Size: 29KB - Virtual size: 29KB

.text
Size: 3.3MB - Virtual size: 3.3MB

.rdata
Size: 900KB - Virtual size: 900KB

.data
Size: 2.3MB - Virtual size: 2.4MB

.pdata
Size: 117KB - Virtual size: 117KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 103KB - Virtual size: 102KB

.reloc
Size: 29KB - Virtual size: 29KB