BakkesMod[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

BakkesMod.exe
Size

15.1MB
MD5

11eff18a407e2764c198d7b1e7dadb14
SHA1

9916e032d1879d9964015b5e79c73d267c10244d
SHA256

7a6b97bf43453c47d905c6f49e3cc6ee8b70f0e289700aa6145f40577ca7b5d4
SHA512

46d7778ef3331386bc1ddc7511339e6db4186e099501af4c09e5b4d90d2608c4e46d0ff7df095069e9ada5d2bb579b1f6652d4c762790e643c3a0b51e771261e
SSDEEP

393216:wqOqPP6NCd/rrpZUOw75iFO7IqJsv6tWKFdu9CNpQG:fyaOtQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BakkesMod.exe

Files

BakkesMod.exe
.exe windows:6 windows x64 arch:x64

6995a2c52a341fe0368e46ac8976ad28

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

RaiseException
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
InitOnceBeginInitialize
InitOnceComplete
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
GetModuleHandleExW
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
LCMapStringEx
GetLocaleInfoEx
CompareStringEx
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
GetCommandLineW
OutputDebugStringW
GetConsoleWindow
GetSystemDirectoryW
DuplicateHandle
WaitForMultipleObjects
CreateThread
GetCurrentThread
GetFileAttributesExW
GetThreadPriority
TerminateThread
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemInfo
GetDateFormatW
GetTimeFormatW
GetCurrencyFormatW
GetFileAttributesW
GetUserPreferredUILanguages
GetSystemTime
GetLocalTime
FlushFileBuffers
GetFileType
GetLogicalDrives
ReadFile
WriteFile
SetErrorMode
UnmapViewOfFile
FindFirstFileW
RemoveDirectoryW
GetVolumePathNamesForVolumeNameW
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
SystemTimeToFileTime
UnregisterWaitEx
RegisterWaitForSingleObject
CompareStringW
LCMapStringW
FindCloseChangeNotification
FindFirstChangeNotificationW
FindNextChangeNotification
FreeLibrary
GetExitCodeProcess
GetTimeZoneInformation
GetGeoInfoW
GetUserGeoID
LocalAlloc
SetHandleInformation
InitializeCriticalSection
lstrcmpW
RtlUnwindEx
SetLastError
RtlUnwind
LoadLibraryExW
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
ExitThread
FreeLibraryAndExitThread
ExitProcess
GetStdHandle
GetCommandLineA
SetStdHandle
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
HeapAlloc
HeapFree
IsValidLocale
EnumSystemLocalesW
GetFileSizeEx
HeapReAlloc
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
HeapSize
WriteConsoleW
GetModuleFileNameW
DeleteFileW
CreateDirectoryW
GetTempPathW
K32GetModuleFileNameExW
K32EnumProcessModules
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetProcAddress
CreateFileA
GetTickCount
VerifyVersionInfoA
GetModuleHandleA
GetSystemDirectoryA
VerSetConditionMask
SleepEx
ExpandEnvironmentStringsA
VirtualFree
VirtualAlloc
CreateMutexW
ReleaseMutex
GetModuleHandleW
IsWow64Process
VirtualFreeEx
Sleep
WaitForSingleObjectEx
CreateSymbolicLinkW
GetFileInformationByHandleEx
CreateHardLinkW
MoveFileExW
CopyFileW
DeviceIoControl
AreFileApisANSI
SetFileTime
SetFilePointerEx
FindNextFileW
FindFirstFileExW
FindClose
CreateFileW
GetCurrentDirectoryW
GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte
DeleteCriticalSection
TryEnterCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
FormatMessageA
QueryPerformanceFrequency
QueryPerformanceCounter
GetDriveTypeW
GetLongPathNameW
GetVolumeInformationW
GetUserDefaultLangID
GetCurrentProcessId
GlobalSize
LoadLibraryW
LoadLibraryA
GetLocaleInfoW
GlobalLock
MapViewOfFile
GlobalUnlock
GlobalAlloc
CheckRemoteDebuggerPresent
ExpandEnvironmentStringsW
WTSGetActiveConsoleSessionId
FormatMessageW
LocalFree
GetCurrentThreadId
RtlPcToFileHeader
SetFileInformationByHandle
SetFileAttributesW
SetEndOfFile
GetFullPathNameW
GlobalFree
GetFileInformationByHandle
GetUserDefaultLCID
CreateFileMappingW
WriteProcessMemory
VirtualAllocEx
GetExitCodeThread
CreateRemoteThread
MoveFileW
GetTickCount64
OpenProcess
CreateProcessW
TerminateProcess
WaitForSingleObject
GetLastError
SetThreadPriority
CloseHandle

shell32

SHGetKnownFolderPath
SHGetFolderPathW
CommandLineToArgvW
Shell_NotifyIconGetRect
Shell_NotifyIconW
SHBrowseForFolderW
SHGetKnownFolderIDList
SHGetPathFromIDListW
SHGetMalloc
SHCreateItemFromParsingName
SHCreateItemFromIDList
ord727
SHGetStockIconInfo
SHGetFileInfoW
ShellExecuteW

ole32

RegisterDragDrop
RevokeDragDrop
OleUninitialize
CoTaskMemFree
StringFromGUID2
CoUninitialize
CoInitializeEx
CoInitialize
OleSetClipboard
OleGetClipboard
OleFlushClipboard
OleIsCurrentClipboard
CoCreateInstance
DoDragDrop
ReleaseStgMedium
CoGetMalloc
CoCreateGuid
CoLockObjectExternal
OleInitialize

advapi32

OpenProcessToken
LookupAccountSidW
GetEffectiveRightsFromAclW
GetNamedSecurityInfoW
BuildTrusteeWithSidW
SystemFunction036
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyExW
RegEnumValueW
RegFlushKey
RegQueryInfoKeyW
RegNotifyChangeKeyValue
GetTokenInformation
GetLengthSid
FreeSid
DuplicateToken
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
AccessCheck
AllocateAndInitializeSid
CopySid
MapGenericMask
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegCreateKeyW
RegDeleteValueW

oleaut32

SafeArrayCreateVector
VariantClear
SafeArrayPutElement
SysFreeString
SysAllocString

dwmapi

DwmEnableBlurBehindWindow
DwmIsCompositionEnabled

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory

iphlpapi

ConvertInterfaceLuidToNameW
ConvertInterfaceNameToLuidW
GetAdaptersAddresses
ConvertInterfaceIndexToLuid
ConvertInterfaceLuidToIndex
ConvertInterfaceLuidToGuid

user32

MsgWaitForMultipleObjectsEx
SetTimer
KillTimer
SetWindowsHookExW
UnhookWindowsHookEx
GetQueueStatus
CharNextExA
RegisterDeviceNotificationW
UnregisterDeviceNotification
MessageBoxW
DrawIconEx
DispatchMessageW
TranslateMessage
ChangeWindowMessageFilterEx
RealGetWindowClassW
EnumWindows
GetWindowTextW
CloseTouchInputHandle
GetTouchInputInfo
GetAsyncKeyState
GetMessageExtraInfo
TrackMouseEvent
GetClipboardFormatNameW
GetCursorInfo
GetIconInfo
CreateIconIndirect
CallNextHookEx
LoadCursorW
GetCursor
CreateCursor
GetDoubleClickTime
IsWindow
MessageBeep
GetCaretBlinkTime
GetDesktopWindow
SystemParametersInfoW
UpdateLayeredWindowIndirect
SendMessageW
PostMessageW
AttachThreadInput
DefWindowProcW
CreateWindowExW
GetKeyboardState
GetKeyState
IsZoomed
PeekMessageW
FindWindowA
SetCaretPos
ShowCaret
HideCaret
DestroyCaret
CreateCaret
IsWindowEnabled
RegisterWindowMessageW
GetKeyboardLayout
RegisterClipboardFormatW
ChangeClipboardChain
SetClipboardViewer
SetCursorPos
LoadIconW
GetSysColor
EnumDisplayMonitors
GetMonitorInfoW
IsChild
DestroyWindow
ShowWindow
UpdateLayeredWindow
SetLayeredWindowAttributes
FlashWindowEx
MoveWindow
SetWindowPos
GetWindowPlacement
SetWindowPlacement
IsWindowVisible
IsIconic
SetFocus
RegisterTouchWindow
UnregisterTouchWindow
IsTouchWindow
GetCapture
SetCapture
ReleaseCapture
GetSystemMetrics
GetSystemMenu
EnableMenuItem
GetForegroundWindow
SetForegroundWindow
GetDC
ReleaseDC
EnumDisplayDevicesW
RegisterClassW
TrackPopupMenuEx
GetMenu
MapVirtualKeyW
ToUnicode
MonitorFromWindow
SetMenuItemInfoW
GetMenuItemInfoW
TrackPopupMenu
RemoveMenu
ModifyMenuW
AppendMenuW
InsertMenuW
DestroyMenu
CreatePopupMenu
CreateMenu
DrawMenuBar
SetMenu
LoadImageW
GetSysColorBrush
ChildWindowFromPointEx
WindowFromPoint
GetFocus
RegisterClassExW
GetClassInfoW
UnregisterClassW
UnregisterPowerSettingNotification
RegisterPowerSettingNotification
GetKeyboardLayoutList
GetAncestor
MonitorFromPoint
DestroyIcon
DestroyCursor
GetWindow
GetWindowThreadProcessId
SetParent
GetParent
SetWindowLongPtrW
GetWindowLongPtrW
SetWindowLongW
GetWindowLongW
ScreenToClient
ClientToScreen
SetCursor
AdjustWindowRectEx
GetWindowRect
GetClientRect
SetWindowTextW
InvalidateRect
SetWindowRgn
GetUpdateRect
EndPaint
BeginPaint
IsHungAppWindow
ToAscii
GetCursorPos

ws2_32

__WSAFDIsSet
getsockopt
getnameinfo
freeaddrinfo
getaddrinfo
ntohl
WSASend
WSAAsyncSelect
WSACleanup
WSAStartup
gethostname
WSASocketW
WSASendTo
WSARecvFrom
WSARecv
WSANtohs
WSANtohl
WSAIoctl
WSAHtonl
WSAConnect
WSAAccept
WSAGetLastError
recv
send
socket
connect
ntohs
WSASetLastError
accept
ioctlsocket
recvfrom
sendto
setsockopt
select
listen
htons
getsockname
bind
closesocket
getpeername
htonl

gdi32

DeleteObject
OffsetRgn
SelectClipRgn
SetLayout
GetDeviceCaps
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCW
DeleteDC
SelectObject
CreateBitmap
ChoosePixelFormat
SetPixelFormat
DescribePixelFormat
GetPixelFormat
SwapBuffers
CreateRectRgn
GetObjectW
CreateFontIndirectW
EnumFontFamiliesExW
GetFontData
GetStockObject
AddFontResourceExW
RemoveFontResourceExW
AddFontMemResourceEx
RemoveFontMemResourceEx
GetTextMetricsW
GetTextFaceW
CreateDIBSection
GdiFlush
GetCharABCWidthsW
GetCharABCWidthsFloatW
GetGlyphOutlineW
GetOutlineTextMetricsW
GetTextExtentPoint32W
GetCharABCWidthsI
SetBkMode
SetGraphicsMode
SetTextColor
SetTextAlign
SetWorldTransform
ExtTextOutW
GetDIBits
GetRegionData
CombineRgn
BitBlt
GetBitmapBits

imm32

ImmGetVirtualKey
ImmSetCandidateWindow
ImmSetCompositionWindow
ImmNotifyIME
ImmGetOpenStatus
ImmReleaseContext
ImmGetDefaultIMEWnd
ImmGetContext
ImmAssociateContextEx
ImmAssociateContext
ImmGetCompositionStringW

winmm

PlaySoundW
timeSetEvent
timeKillEvent

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

netapi32

NetApiBufferFree
NetShareEnum

userenv

GetUserProfileDirectoryW

uxtheme

IsThemeActive
SetWindowTheme
GetThemeBool
IsThemeBackgroundPartiallyTransparent
GetThemeBackgroundRegion
ord47
GetCurrentThemeName
GetThemeTransitionDuration
GetThemePropertyOrigin
GetThemeMargins
GetThemeEnumValue
GetThemeInt
GetThemeColor
GetThemePartSize
OpenThemeData
IsAppThemed
CloseThemeData

crypt32

CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertAddCertificateContextToStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore

wldap32

ord211
ord46
ord60
ord45
ord217
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord143
ord50

normaliz

IdnToAscii

Sections

.text
Size: 10.2MB - Virtual size: 10.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 148KB - Virtual size: 237KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 482KB - Virtual size: 481KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qtmetad
Size: 512B - Virtual size: 401B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 162KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6995a2c52a341fe0368e46ac8976ad28

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

shell32

ole32

advapi32

oleaut32

dwmapi

wtsapi32

iphlpapi

user32

ws2_32

gdi32

imm32

winmm

version

netapi32

userenv

uxtheme

crypt32

wldap32

normaliz

Sections

.text Size: 10.2MB - Virtual size: 10.2MB

.rdata Size: 4.1MB - Virtual size: 4.1MB

.data Size: 148KB - Virtual size: 237KB

.pdata Size: 482KB - Virtual size: 481KB

.qtmetad Size: 512B - Virtual size: 401B

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 162KB - Virtual size: 162KB

.reloc Size: 55KB - Virtual size: 55KB

.text
Size: 10.2MB - Virtual size: 10.2MB

.rdata
Size: 4.1MB - Virtual size: 4.1MB

.data
Size: 148KB - Virtual size: 237KB

.pdata
Size: 482KB - Virtual size: 481KB

.qtmetad
Size: 512B - Virtual size: 401B

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 162KB - Virtual size: 162KB

.reloc
Size: 55KB - Virtual size: 55KB