Static task
static1
Behavioral task
behavioral1
Sample
five-nights-at-bonnies-remastered.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
five-nights-at-bonnies-remastered.exe
Resource
win10v2004-20240508-en
General
-
Target
five-nights-at-bonnies-remastered.exe
-
Size
544.1MB
-
MD5
e1cd12b210bf8ef20d42b8ae22bde366
-
SHA1
5a00d8b491b2455e0590f2c9d65ebd3035cab440
-
SHA256
ec15a2884d81ad75bbc55aaf06c85718379e4e1361e963ec394949e9306f495a
-
SHA512
ffdf182109310e7d666b5fc7ca684c6a08ae74dc4070218641b6c100e529857a1b10b2de22490c8da3c5028f76fb7b74de956997eb1d792b05665711e0440f67
-
SSDEEP
12582912:Ekrd1pNTwvMz4+cWRm5qIPg8ZhQOYVMbkRuT9FgQ:EkFNTwMfcSCFI8UO4MdpFgQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource five-nights-at-bonnies-remastered.exe
Files
-
five-nights-at-bonnies-remastered.exe.exe windows:4 windows x86 arch:x86
Password: 12345678
5a1671ab6bda57efd392013e28a7fb13
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTempFileNameW
GetTempPathW
CreateDirectoryW
RemoveDirectoryW
FindClose
FindNextFileW
FindFirstFileW
Sleep
SetCurrentDirectoryW
CloseHandle
GetExitCodeProcess
CreateProcessW
GetCommandLineW
GetModuleFileNameW
GetStringTypeW
GetStringTypeA
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
CreateFileW
GetLastError
ReadFile
WriteFile
SetFilePointer
WideCharToMultiByte
MultiByteToWideChar
HeapFree
HeapAlloc
DeleteFileW
ExitProcess
TerminateProcess
GetCurrentProcess
SetEnvironmentVariableW
GetCurrentDirectoryW
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
RtlUnwind
HeapCompact
HeapReAlloc
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
LCMapStringA
LCMapStringW
GetCPInfo
user32
wsprintfW
PeekMessageW
GetMessageW
MsgWaitForMultipleObjects
TranslateMessage
DispatchMessageW
LoadStringW
MessageBoxW
Sections
.text Size: 40KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 292KB - Virtual size: 291KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ