BitSync[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

BitSync.exe
Size

4.6MB
MD5

ff617557e58bcfcf3599151df3a8ce6b
SHA1

f350419d8bca67d09e302268669d09c6e055ecd3
SHA256

e4fc5e53b95042fdc732bfdb705d226dfee02f98a952886599512d0e3e3454d9
SHA512

4ddc02d59e9a033d450c1a37847c935e28831a54567554be3418bd1436df56e9d96d8142120520e2f4fc53bbc46bc67fa6c5585a85846f0a955db60aa4f04a50
SSDEEP

98304:MZpJ6YNGUOoNAZQPFDL8xGRfC5/6C/QySEb8uQEgYtf8IloQe:MrJHNG7oN5axlV6CIkXQErt7Ve

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BitSync.exe

Files

BitSync.exe
.exe windows:6 windows x64 arch:x64

Password: 3432

5e4699147470738487e2d69ff09d4271

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegQueryValueA

kernel32

GetModuleHandleA

shell32

PathMakeUniqueName

user32

EndDialog

Sections

.rsrc
Size: - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: - Virtual size: 3.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 265KB - Virtual size: 265KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 179KB - Virtual size: 179KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: - Virtual size: 5.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE