bcc9bf1df30e06826222db4e89f07187f0365f398f37849e901a9588dbea85d1

Sharing

Copy URL Twitter E-mail

General

Target
bcc9bf1df30e06826222db4e89f07187f0365f398f37849e901a9588dbea85d1
Size 352KB
Sample240614-dx65batcld
SHA256 bcc9bf1df30e06826222db4e89f07187f0365f398f37849e901a9588dbea85d1
MD5 9d7d5cee25d305f10895e10dc927cd7c
SHA1 01e57ee6e21dc5f3b6b5343c2f4d474b5f0cdb1f
SHA512 d7ac0f1b81dee6f02361d239b3ad9f4a7d3ab40b0532973b82da462f8b489d9bce385669c038b4e5ad44ddf88647b863424ebaddfe9ca1bce2315b5fb12c17c1
SSDEEP 6144:eIs9OKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPFsEPAsKCe8i:DKofHfHTXQLzgvnzHPowYbvrjD/L7QPs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bcc9bf1df30e06826222db4e89f07187f0365f398f37849e901a9588dbea85d1

File Explorer

bcc9bf1df30e06826222db4e89f07187f0365f398f37849e901a9588dbea85d1

.exe 352KB

bcc9bf1df30e06826222db4e89f07187f0365f398f37849e901a9588dbea85d1

IMPHASH 4ef23820f834df2be399d0ac2d982700
SHA256 bcc9bf1df30e06826222db4e89f07187f0365f398f37849e901a9588dbea85d1
MD5 9d7d5cee25d305f10895e10dc927cd7c
SHA1 01e57ee6e21dc5f3b6b5343c2f4d474b5f0cdb1f
SHA512 d7ac0f1b81dee6f02361d239b3ad9f4a7d3ab40b0532973b82da462f8b489d9bce385669c038b4e5ad44ddf88647b863424ebaddfe9ca1bce2315b5fb12c17c1
SSDEEP 6144:eIs9OKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPFsEPAsKCe8i:DKofHfHTXQLzgvnzHPowYbvrjD/L7QPs
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX dump on OEP (original entry point)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

121559

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges CryptAcquireContextA CryptCreateHash CryptDestroyHash CryptGetHashParam CryptHashData CryptReleaseContext LookupPrivilegeValueA OpenProcessToken RegCloseKey RegCreateKeyExA RegOpenKeyExA RegQueryValueExA RegSetValueExA

kernel32

AddAtomA CloseHandle CopyFileA CreateFileA CreateFileMappingA CreateMutexA CreateProcessA CreateSemaphoreA CreateThread CreateToolhelp32Snapshot DeleteFileA ExitProcess FindAtomA FindClose FindFirstFileA FindNextFileA FreeLibrary GetAtomNameA GetCurrentProcess GetCurrentProcessId GetDriveTypeA GetFileSize GetFileTime GetLastError GetLocalTime GetModuleFileNameA GetModuleHandleA GetProcAddress GetProcessHeap GetSystemDirectoryA GetSystemTime GetTickCount GetVersionExA GlobalAlloc GlobalFree HeapAlloc HeapFree HeapReAlloc InterlockedDecrement InterlockedIncrement IsBadReadPtr IsDebuggerPresent LoadLibraryA MapViewOfFile OpenProcess Process32First Process32Next ReadFile ReleaseSemaphore SetErrorMode SetFilePointer SetFileTime SetLastError SetUnhandledExceptionFilter Sleep TerminateProcess TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile WaitForSingleObject WriteFile lstrcatA lstrcmpA lstrcpyA lstrcpynA lstrlenA

msvcrt

_itoa __getmainargs __p__environ __p__fmode __set_app_type _cexit _iob _onexit _setmode abort atexit atoi fclose fflush fgetc fopen fprintf fread free fseek ftell malloc memcpy memmove memset rand realloc rewind signal sprintf srand sscanf _mbscat strchr strcmp _mbscpy strstr strtok

user32

CharLowerA wsprintfA

dnsapi

DnsQuery_A

wininet

InternetGetConnectedState

ws2_32

WSAConnect WSASocketA WSAStartup closesocket connect gethostbyname gethostname htons inet_addr inet_ntoa recv send sendto setsockopt socket

Name

5833eiui

Size

73KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

5625oydu

Size

39KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

e67fplvq

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

chxEENzG

Size

3KB

Virtual Size

3KB

Characteristics

Name

gPixCrfq

Size

47KB

Virtual Size

47KB

Characteristics

Name

sHYNTgKh

Size

52KB

Virtual Size

52KB

Characteristics

Name

bbKYwKaO

Size

12KB

Virtual Size

12KB

Characteristics

Name

qaWCKgSI

Size

1024B

Virtual Size

709B

Characteristics

Name

UFRiXnri

Size

1024B

Virtual Size

979B

Characteristics

Name

CSNYnvfn

Size

49KB

Virtual Size

49KB

Characteristics

Name

wdMGVLFy

Size

3KB

Virtual Size

3KB

Characteristics

Name

iCRRBead

Size

33KB

Virtual Size

32KB

Characteristics

Name

DXbSFgdG

Size

29KB

Virtual Size

29KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

bcc9bf1df30e06826222db4e89f07187f0365f398f37849e901a9588dbea85d1

advapi32

kernel32

msvcrt

user32

dnsapi

wininet

ws2_32

generic