bleed[.]exe | Triage

Resubmissions

14/06/2024, 22:03

240614-1yessaxfqe 6

14/06/2024, 21:52

240614-1q112sxdng 6

Sharing

Copy URL Twitter E-mail

General

Target

bleed.exe
Size

15.6MB
MD5

625ab2b1b7c8391beb71f2b8f5c87b9f
SHA1

3fd4731e4edbf650193d4985969bce2846247a79
SHA256

afc2ef7d33c387b6f07d4e1e6749bdf1c72e90d6b31b16ba1a350e46939467cf
SHA512

49064dbb34f18ac11dd7415172b91ed4f923d2a5a6c7d9eb3111d7a1fc0a6b665f3bb7a2972851d9a6d753d646b4e066795ef9dad98421e19a476231f0c1267a
SSDEEP

98304:7FzYIa1RgSi/1HqSbpJAlhpBgVlWAulhB7Gs1Sb95q2H+sScpui8EKiZAv6gga5g:79YIa+HqSggIhB7Gskb/HyLw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bleed.exe

Files

bleed.exe
.exe windows:6 windows x64 arch:x64

b46dca107d01295f1e75599a333c23b6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-core-synch-l1-2-0

WakeByAddressAll
WakeByAddressSingle
WaitOnAddress

bcryptprimitives

ProcessPrng

advapi32

RegCloseKey
CredReadW
RegQueryValueExW
RegOpenKeyExW
SystemFunction036
ImpersonateAnonymousToken
RevertToSelf

kernel32

ReleaseSRWLockExclusive
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateThread
LoadLibraryExW
HeapFree
HeapReAlloc
GetConsoleMode
SetConsoleMode
GetLastError
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
SwitchToThread
CloseHandle
GetTimeZoneInformationForYear
GetCurrentThread
GlobalUnlock
GetStdHandle
GetFileInformationByHandleEx
SetConsoleCursorPosition
FillConsoleOutputCharacterA
FillConsoleOutputAttribute
SetConsoleCursorInfo
GetConsoleCursorInfo
ReadConsoleInputW
GetNumberOfConsoleInputEvents
lstrlenW
FormatMessageW
WideCharToMultiByte
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetSystemInfo
WaitForMultipleObjects
ResetEvent
MoveFileExW
DeleteFileW
CopyFileExW
FindFirstFileW
FindClose
SetEnvironmentVariableW
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
RegisterWaitForSingleObject
CreateIoCompletionPort
SetFileCompletionNotificationModes
GetQueuedCompletionStatusEx
Sleep
GetModuleHandleA
GetProcAddress
GlobalLock
GlobalSize
WriteConsoleW
LockFileEx
SetFileInformationByHandle
UnlockFile
WaitForSingleObject
MultiByteToWideChar
SetLastError
QueryPerformanceFrequency
GetModuleHandleW
GetCurrentDirectoryW
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcess
GetCurrentProcessId
CreateMutexA
ReleaseMutex
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
GetEnvironmentVariableW
GetModuleFileNameW
GetCommandLineW
CreateFileW
GetFileInformationByHandle
GetFullPathNameW
GetFinalPathNameByHandleW
SetFilePointerEx
CreateDirectoryW
ReadConsoleW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
CreateNamedPipeW
AcquireSRWLockExclusive
ReadFileEx
SleepEx
WriteFileEx
ExitProcess
GetExitCodeProcess
QueryPerformanceCounter
GetSystemTimePreciseAsFileTime
HeapAlloc
GetProcessHeap
GetFileType
SetHandleInformation
UnregisterWaitEx
TerminateProcess
PostQueuedCompletionStatus
FindNextFileW
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
RtlAddFunctionTable
RtlDeleteFunctionTable
WakeAllConditionVariable
FreeLibrary
TlsFree
SleepConditionVariableSRW
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EncodePointer
RaiseException
RtlPcToFileHeader
RtlUnwindEx

ole32

CoTaskMemFree

shell32

SHGetKnownFolderPath

user32

OpenClipboard
CloseClipboard
GetClipboardData

bcrypt

BCryptGenRandom

ws2_32

freeaddrinfo
WSAStartup
accept
listen
bind
connect
getaddrinfo
WSAIoctl
socket
WSASocketW
getsockname
WSAGetLastError
getpeername
WSACleanup
closesocket
setsockopt
recv
send
WSASend
shutdown
ioctlsocket
getsockopt

ntdll

NtDeviceIoControlFile
NtReadFile
NtWriteFile
RtlNtStatusToDosError
NtCancelIoFileEx
NtCreateFile

api-ms-win-crt-math-l1-1-0

fminf
pow
fmod
fmodf
cosf
sinf
round
roundf
asinf
ceilf
floorf
trunc
fmaxf
__setusermatherr
truncf
_dsign
ceil
log2f
atan2f
tanh
tan
sqrt
sinh
sin
log2
log10
log
floor
exp
cosh
cos
atan2
atan
asin
acos
modf
frexp
ldexp

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
terminate
_register_onexit_function
_initialize_onexit_table
_wassert
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
__p___argc
_exit
exit
abort
strerror
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_invalid_parameter_noinfo_noreturn
_configure_narrow_argv
_set_app_type
_seh_filter_exe
_errno

api-ms-win-crt-string-l1-1-0

strcmp
strcpy_s
strncat
strlen
isalpha
isupper
islower
isdigit
isxdigit
isspace
ispunct
strspn
strcspn
isalnum
isgraph
iscntrl
toupper
strpbrk
tolower
strncpy
strnlen
wcsncmp

api-ms-win-crt-heap-l1-1-0

_set_new_mode
_aligned_malloc
_aligned_free
_callnewh
realloc
calloc
malloc
free

api-ms-win-crt-utility-l1-1-0

_rotl64

api-ms-win-crt-stdio-l1-1-0

__p__commode
__acrt_iob_func
__stdio_common_vsprintf
fwrite
_set_fmode

api-ms-win-crt-convert-l1-1-0

strtoul
strtoull
atoi
strtod

api-ms-win-crt-time-l1-1-0

strftime
_localtime64_s
clock
_gmtime64_s
_difftime64
_time64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

msvcp140

?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z

Sections

.text
Size: 10.4MB - Virtual size: 10.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4.6MB - Virtual size: 4.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 499KB - Virtual size: 499KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

b46dca107d01295f1e75599a333c23b6

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-core-synch-l1-2-0

bcryptprimitives

advapi32

kernel32

ole32

shell32

user32

bcrypt

ws2_32

ntdll

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

msvcp140

Sections

.text Size: 10.4MB - Virtual size: 10.4MB

.rdata Size: 4.6MB - Virtual size: 4.6MB

.data Size: 27KB - Virtual size: 29KB

.pdata Size: 499KB - Virtual size: 499KB

_RDATA Size: 512B - Virtual size: 500B

.reloc Size: 74KB - Virtual size: 73KB

.text
Size: 10.4MB - Virtual size: 10.4MB

.rdata
Size: 4.6MB - Virtual size: 4.6MB

.data
Size: 27KB - Virtual size: 29KB

.pdata
Size: 499KB - Virtual size: 499KB

_RDATA
Size: 512B - Virtual size: 500B

.reloc
Size: 74KB - Virtual size: 73KB