BLACK_BULL[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

BLACK_BULL.exe
Size

4.1MB
MD5

124e24f5c6933a406d6bdeea90aea8b4
SHA1

a530b83fb193584a4a4f876ebb41cb9699983575
SHA256

b4d7ec8c4bd698c98073a06eef1f71a52fdec318dde3ec5ff6b40c1111cdefbb
SHA512

8ec311df433a97d200a8202f7b3fa248035c98ea38853299ac47b9d8f5f74f1a28faa70f4adcdabb5f9b7d4df30c9bf7426666a6b673819b134ad985cd608b92
SSDEEP

49152:Kw+E4CuBP20keH0DLH1rnyiKc59SfTp59SfTIsLmqu2vTclkzEvKToQ355c:31uZ20QtKispsfmh2vT3zoQJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BLACK_BULL.exe

Files

BLACK_BULL.exe
.exe windows:6 windows x64 arch:x64

f28ef8fdce6f430011c491ac1f6cec7c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\crack\Desktop\PhotoshopCS6(Portable)\imgui factura\imgui factura\examples\example_win32_directx11\Release\BLACK BULL.pdb

Imports

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

WaitForMultipleObjects
GetFileType
GetStdHandle
GetEnvironmentVariableA
WaitForSingleObjectEx
MoveFileExA
VerifyVersionInfoA
GetSystemDirectoryA
GetModuleHandleW
SleepEx
LeaveCriticalSection
EnterCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
LocalFree
WakeAllConditionVariable
FormatMessageA
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
SetLastError
CheckRemoteDebuggerPresent
VirtualQueryEx
IsDebuggerPresent
AllocConsole
GetTickCount
VirtualFreeEx
CreateRemoteThread
WinExec
DeleteCriticalSection
VirtualAllocEx
Beep
GetStartupInfoW
GetCurrentThreadId
HeapAlloc
HeapReAlloc
HeapFree
GetProcessHeap
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
GetThreadContext
GetLocalTime
Process32Next
GetCurrentThread
CreateFileA
GetTickCount64
Sleep
CreateToolhelp32Snapshot
OpenProcess
WaitForSingleObject
InitializeCriticalSectionEx
TerminateProcess
CreateThread
HeapSize
VirtualAlloc
GetCurrentProcess
Process32First
GetModuleFileNameW
lstrlenW
WaitNamedPipeW
GetCurrentProcessId
CloseHandle
GetLastError
CreateFileW
PeekNamedPipe
WriteFile
ReadFile
ReadProcessMemory
VirtualProtectEx
WriteProcessMemory
QueryPerformanceCounter
FreeLibrary
VerSetConditionMask
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA
GetModuleHandleA
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
HeapDestroy
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GlobalAlloc
MultiByteToWideChar
GetFileSizeEx

user32

SetCursorPos
ReleaseCapture
IsWindowUnicode
GetClientRect
SetCursor
SetCapture
GetForegroundWindow
TrackMouseEvent
ClientToScreen
GetCapture
ScreenToClient
SetLayeredWindowAttributes
GetCursorPos
LoadCursorA
GetMessageExtraInfo
GetKeyState
UpdateWindow
FindWindowA
MoveWindow
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
MessageBoxA
SetWindowDisplayAffinity
GetWindowLongA
SetWindowLongA
GetAsyncKeyState
ShowWindow
GetActiveWindow
RegisterClassExW
UnregisterClassW
SetClipboardData
LoadIconA
PeekMessageA
TranslateMessage
GetSystemMetrics
PostQuitMessage
DefWindowProcW
DispatchMessageA
GetWindowRect
DestroyWindow
CreateWindowExW
GetDesktopWindow

advapi32

CryptImportKey
RegSetValueExW
RegCreateKeyExW
RegCloseKey
CryptEncrypt
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
ConvertSidToStringSidA
GetTokenInformation
GetLengthSid
CopySid
IsValidSid
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

shell32

ShellExecuteA

ole32

CoCreateInstance
CoUninitialize
CoInitialize

msvcp140

?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?_Xbad_function_call@std@@YAXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
_Xtime_get_ticks
_Cnd_init_in_situ
_Query_perf_frequency
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_timedwait
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_init_in_situ
_Cnd_do_broadcast_at_thread_exit
_Query_perf_counter
_Mtx_unlock
_Cnd_broadcast
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
_Thrd_detach

imm32

ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

urlmon

URLDownloadToFileA

winmm

sndPlaySoundA

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
NtRaiseHardError
RtlAdjustPrivilege

normaliz

IdnToAscii

wldap32

ord301
ord143
ord211
ord60
ord45
ord217
ord46
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord50

crypt32

CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertAddCertificateContextToStore
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertFreeCertificateContext

ws2_32

closesocket
ntohl
gethostname
sendto
recvfrom
freeaddrinfo
getaddrinfo
__WSAFDIsSet
ioctlsocket
listen
htonl
accept
WSACleanup
WSAStartup
WSAIoctl
WSASetLastError
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
bind
WSAGetLastError
send
recv
select

rpcrt4

UuidCreate
UuidToStringA
RpcStringFreeA

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strchr
__current_exception
__current_exception_context
memmove
__intrinsic_setjmp
memcmp
longjmp
strrchr
strstr
memchr
__std_terminate
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memcpy
memset
__C_specific_handler

api-ms-win-crt-stdio-l1-1-0

_lseeki64
fread
fgets
fclose
__stdio_common_vsscanf
feof
fputs
fputc
fwrite
_set_fmode
__p__commode
_wfopen
_read
_write
_close
__stdio_common_vswprintf
_open
__stdio_common_vfprintf
ftell
__stdio_common_vsprintf_s
__acrt_iob_func
fopen
fseek
fflush
__stdio_common_vsprintf

api-ms-win-crt-utility-l1-1-0

rand
qsort

api-ms-win-crt-string-l1-1-0

_strdup
strncmp
strcpy_s
strcmp
strncpy
tolower
isupper
strcspn
strspn
strpbrk

api-ms-win-crt-heap-l1-1-0

calloc
malloc
_callnewh
realloc
free
_set_new_mode

api-ms-win-crt-runtime-l1-1-0

exit
system
_errno
_beginthreadex
_invalid_parameter_noinfo_noreturn
abort
strerror
__sys_nerr
_invalid_parameter_noinfo
_register_thread_local_exe_atexit_callback
_c_exit
_resetstkoflw
_exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_wassert
_getpid
terminate

api-ms-win-crt-convert-l1-1-0

atoi
strtod
strtoll
strtoull
strtoul
strtol

api-ms-win-crt-time-l1-1-0

_gmtime64
_time64

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp

api-ms-win-crt-locale-l1-1-0

localeconv
_configthreadlocale

api-ms-win-crt-math-l1-1-0

_dclass
sqrtf
cosf
powf
sinf
acosf
ceilf
__setusermatherr
fmodf

api-ms-win-crt-filesystem-l1-1-0

_access
_stat64
_fstat64
_unlink

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 340KB - Virtual size: 340KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.5MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f28ef8fdce6f430011c491ac1f6cec7c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

d3d11

d3dcompiler_43

kernel32

user32

advapi32

shell32

ole32

msvcp140

imm32

dwmapi

d3dx11_43

urlmon

winmm

ntdll

normaliz

wldap32

crypt32

ws2_32

rpcrt4

psapi

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 340KB - Virtual size: 340KB

.data Size: 2.5MB - Virtual size: 2.7MB

.pdata Size: 54KB - Virtual size: 53KB

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 340KB - Virtual size: 340KB

.data
Size: 2.5MB - Virtual size: 2.7MB

.pdata
Size: 54KB - Virtual size: 53KB

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 5KB - Virtual size: 4KB