BurntSushi[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

BurntSushi.exe
Size

8.6MB
MD5

64c0351a90a5ac5d88e2ea19265ba545
SHA1

177db3974d47e840abe137659bdc76188576ee94
SHA256

0c46f4babeb379fc920d7b1326201c0977706504bdea593ed2a7c6586d56b582
SHA512

c44ab607308600249bb98ae4cef217724888b98d0478882eb7d121ae47127163b6c6f92237927129a575f597a08399d9c1c1caefd031172f69a5e140ce73f0dd
SSDEEP

98304:Z4/unW9PsFCM9PWeREQTOIAWIyAQLbp+AzCkR:ZcyNEXKLtfR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BurntSushi.exe

Files

BurntSushi.exe
.exe windows:6 windows x64 arch:x64

9b9cfe9d4f0abece0d390afbd06f07b1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CreateSemaphoreA
SetConsoleCtrlHandler
CreateToolhelp32Snapshot
Thread32First
Thread32Next
SwitchToThread
VirtualQueryEx
DuplicateHandle
GetModuleFileNameW
CreateRemoteThread
GetExitCodeThread
VirtualFreeEx
GetExitCodeProcess
WakeConditionVariable
CreatePipe
SetHandleInformation
CreateProcessW
QueryPerformanceCounter
GetStdHandle
GetConsoleMode
GetFileInformationByHandleEx
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
FillConsoleOutputCharacterA
FillConsoleOutputAttribute
SetConsoleMode
ReleaseSemaphore
HeapReAlloc
SetFilePointerEx
lstrlenW
GetProcAddress
GetSystemWow64DirectoryW
GetSystemWow64DirectoryA
ReadProcessMemory
WriteProcessMemory
GetSystemInfo
VirtualAllocEx
GetTimeZoneInformationForYear
AllocConsole
SetThreadStackGuarantee
AddVectoredExceptionHandler
GetQueuedCompletionStatusEx
OpenProcess
GetCurrentProcess
CreateIoCompletionPort
SetFileCompletionNotificationModes
TryAcquireSRWLockExclusive
SetLastError
QueryFullProcessImageNameW
AcquireSRWLockShared
TerminateProcess
FreeConsole
ReleaseSRWLockShared
FlushInstructionCache
IsWow64Process
ReleaseMutex
CreateMutexW
WaitForSingleObject
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
PostQueuedCompletionStatus
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FreeLibrary
GetTempPathW
GetTempFileNameW
CreateActCtxW
ActivateActCtx
GetModuleHandleW
WakeAllConditionVariable
SleepConditionVariableSRW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
QueryPerformanceFrequency
CopyFileExW
MoveFileExW
LocalFree
GetCurrentThread
CloseHandle
GetCommandLineW
AttachConsole
DeleteFileW
CreateProcessA
ExitProcess
GetModuleHandleA
MultiByteToWideChar
WriteConsoleW
FormatMessageW
GetCurrentDirectoryW
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcessId
CreateMutexA
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
GetEnvironmentVariableW
CreateFileW
SetFileInformationByHandle
GetFileInformationByHandle
GetFullPathNameW
GetFinalPathNameByHandleW
CreateDirectoryW
FindFirstFileW
FindClose
DeviceIoControl
GetVolumeInformationW
GetDriveTypeW
GetDiskFreeSpaceExW
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
GetFileAttributesW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
GetSystemTimeAsFileTime
GetProcessHeap
HeapAlloc
GetLogicalDrives
GetProcessTimes
GetSystemTimes
GetProcessIoCounters
GetConsoleWindow
GetTickCount64
GlobalMemoryStatusEx
HeapFree
GetLastError
GetProcessId
IsProcessorFeaturePresent

advapi32

OpenThreadToken
RevertToSelf
MapGenericMask
AccessCheck
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
CopySid
LookupAccountSidW
GetLengthSid
ImpersonateSelf
SystemFunction036
GetTokenInformation
GetSidIdentifierAuthority
IsValidSid
GetNamedSecurityInfoW
OpenProcessToken

user32

SetMenu
DrawMenuBar
LoadCursorW
RegisterClassExW
CreateWindowExW
DestroyIcon
EnumChildWindows
GetMessageW
GetAncestor
CreatePopupMenu
AppendMenuW
DeleteMenu
GetMenuItemCount
DestroyMenu
CreateMenu
SetParent
GetParent
DefWindowProcW
ShowWindow
SendMessageW
GetMenuItemID
GetSubMenu
SetMenuInfo
TranslateMessage
DispatchMessageW
SetWinEventHook
CreateWindowExA
PeekMessageW
MsgWaitForMultipleObjects
LoadImageW
GetMenu
PostMessageW
GetWindowThreadProcessId
EnumThreadWindows
DestroyWindow
IsDialogMessageW
GetClassNameW
GetWindowTextW
GetWindowTextLengthW
UnhookWinEvent
PostThreadMessageW
GetCursorPos
SetMenuItemInfoW
SetForegroundWindow
TrackPopupMenu
CheckMenuItem

shell32

CommandLineToArgvW
ShellExecuteW
SHGetKnownFolderPath
DragFinish
Shell_NotifyIconW

comctl32

RemoveWindowSubclass
GetWindowSubclass
SetWindowSubclass
InitCommonControlsEx
DefSubclassProc

ws2_32

connect
getsockopt
WSAGetLastError
closesocket
setsockopt
WSAStartup
freeaddrinfo
getsockname
ioctlsocket
WSAIoctl
bind
getaddrinfo
shutdown
getpeername
recv
send
WSASend
WSACleanup
WSASocketW
socket

ntdll

NtCancelIoFileEx
NtReadFile
RtlGetVersion
NtCreateFile
RtlNtStatusToDosError
NtWriteFile
NtDeviceIoControlFile
NtQueryInformationProcess
NtQuerySystemInformation

ole32

CoInitializeSecurity
CoUninitialize
CoSetProxyBlanket
CoInitialize
CoCreateInstance
CoTaskMemFree
CoInitializeEx

bcrypt

BCryptGenRandom

pdh

PdhOpenQueryA
PdhCollectQueryData
PdhCloseQuery
PdhGetFormattedCounterValue
PdhRemoveCounter
PdhAddEnglishCounterW

iphlpapi

FreeMibTable
GetIfEntry2
GetAdaptersAddresses
GetIfTable2

netapi32

NetUserGetLocalGroups
NetUserGetInfo
NetUserEnum
NetApiBufferFree

secur32

LsaGetLogonSessionData
LsaEnumerateLogonSessions
LsaFreeReturnBuffer

powrprof

CallNtPowerInformation

oleaut32

GetErrorInfo
SysStringLen
SetErrorInfo
SysAllocString
SysFreeString
VariantClear

psapi

GetModuleBaseNameW
EnumProcessModulesEx
GetModuleFileNameExW
GetPerformanceInfo

vcruntime140

_CxxThrowException
memset
memcmp
__current_exception
__current_exception_context
memmove
memcpy
__CxxFrameHandler3
__C_specific_handler

api-ms-win-crt-math-l1-1-0

__setusermatherr
ceil
pow
round
trunc
truncf

api-ms-win-crt-convert-l1-1-0

_wtoi64

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free
realloc

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
terminate
_initialize_onexit_table
_seh_filter_exe
_initterm
_set_app_type
_get_initial_narrow_environment
_initterm_e
exit
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
__p___argc
_exit
_configure_narrow_argv
_register_onexit_function
_initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 190KB - Virtual size: 190KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 421KB - Virtual size: 420KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9b9cfe9d4f0abece0d390afbd06f07b1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

user32

shell32

comctl32

ws2_32

ntdll

ole32

bcrypt

pdh

iphlpapi

netapi32

secur32

powrprof

oleaut32

psapi

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 4.4MB - Virtual size: 4.4MB

.rdata Size: 3.5MB - Virtual size: 3.5MB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 190KB - Virtual size: 190KB

.rsrc Size: 421KB - Virtual size: 420KB

.reloc Size: 20KB - Virtual size: 20KB

.text
Size: 4.4MB - Virtual size: 4.4MB

.rdata
Size: 3.5MB - Virtual size: 3.5MB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 190KB - Virtual size: 190KB

.rsrc
Size: 421KB - Virtual size: 420KB

.reloc
Size: 20KB - Virtual size: 20KB