bvyKq[.]eXa | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bvyKq.eXa
Size

1.3MB
MD5

1a1bc1024d3d0f14cec9ebf0089bbda3
SHA1

6c715e9a496c38b396dd78217c040bd39b3b26ab
SHA256

cc5b54b691161d8454aaa44c563033e65514e979433701c2e9b4aa096dbedf9a
SHA512

30b63d3ecb6c18b7c5401e8de8cdf4e307e6312e9623cf87e24961b65f37ebadd8b8b165dd82a78784553d666ea567ddc4442a462749d4da4862b67647361746
SSDEEP

24576:7O/xpptywT0ITciU6F8WKiJ0JjETv7F16w62tS6R5sBiE2pvDku/QcVRQnVYdbxi:7OPdT0ITXFjKiaJwTZn62tS6R5sBiE2e

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bvyKq.eXa

Files

bvyKq.eXa
.dll windows:4 windows x86 arch:x86

8283bd43c9d87e9d4a0607ad4fb52e69

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

??1type_info@@UAE@XZ
strncpy
_initterm
_onexit
??2@YAPAXI@Z
malloc
memset
free
??0exception@@QAE@ABV0@@Z
_adjust_fdiv
memmove
??1exception@@UAE@XZ
??0exception@@QAE@XZ
__dllonexit
_CxxThrowException
__CxxFrameHandler
??3@YAXPAX@Z
fwrite
strtol
fputc
_fileno
fprintf
signal
localtime
qsort
_setmode
strncmp
abort
vfprintf
wcsstr
_lrotl
_putenv
_read
__RTDynamicCast
fclose
fread
fopen
strlen
strstr
clock
sprintf
memcpy
realloc
sscanf
memcmp
strchr
rename
remove
?name@type_info@@QBEPBDXZ
strerror
_errno
tolower
toupper
strcoll
strcmp
atoi
wcstombs
mbstowcs
_vsnprintf
_open
calloc
_iob
strrchr
_sys_nerr
time
getenv
strtoul
_pctype
_isctype
__mb_cur_max
strcpy
fseek
memchr
fgets
fputs
strcat
_close
_getch
_beginthreadex
fflush
_ftol
gmtime
_lseeki64
_fstati64
mktime
_stati64
rand
srand
ftell
_stat
_getcwd
_chdir
_mkdir
_rmdir
_strdup
_stricmp
_strnicmp

kernel32

DuplicateHandle
CreateEventA
CreateMutexA
WaitForMultipleObjects
DisableThreadLibraryCalls
CloseHandle
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
FreeLibrary
GetProcAddress
LoadLibraryA
GetLastError
Sleep
GetSystemDirectoryA
FindClose
FindNextFileA
FindFirstFileA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
FormatMessageA
GetCurrentProcess
ReleaseMutex
SetEvent
GetExitCodeThread
TerminateThread
GetTickCount
GetCurrentThreadId
FlushConsoleInputBuffer
GetCurrentProcessId
SetLastError
PeekNamedPipe
ReadFile
GetFileType
GetStdHandle
ExpandEnvironmentStringsA
SleepEx
GetVersionExA
QueryPerformanceCounter
GlobalMemoryStatus
GetVersion

oleaut32

SysFreeString
GetErrorInfo
SetErrorInfo
CreateErrorInfo

wsock32

recv
connect
inet_ntoa
ioctlsocket
getsockopt
getsockname
accept
inet_addr
setsockopt
socket
send
bind
WSASetLastError
htons
ntohs
closesocket
WSAStartup
WSACleanup
listen
select
gethostbyname
WSAGetLastError
recvfrom
__WSAFDIsSet
sendto

winmm

timeGetTime

advapi32

ReportEventA
RegisterEventSourceA
DeregisterEventSource

user32

MessageBoxIndirectA
GetProcessWindowStation
GetUserObjectInformationW
GetDesktopWindow

gdi32

DeleteObject
GetBitmapBits
DeleteDC
BitBlt
GetObjectA
SelectObject
CreateCompatibleBitmap
GetDeviceCaps
CreateCompatibleDC
CreateDCA

Exports

Exports

Test
Upd_AttachVerifyTrustCallback
Upd_DetachDebugLogCallback
Upd_DetachVerifyTrustCallback
Upd_ErrorInfo_GetErrorCode
Upd_ErrorInfo_GetMessage
Upd_ErrorInfo_GetMessageSize
Upd_GetPackageStateString
Upd_GetPackageStateStringSize
Upd_GetVersion
Upd_MergeConfigurationFiles
Upd_Package_GetDerivedPackage
Upd_Package_GetDerivedPackageCount
Upd_Package_GetDescription
Upd_Package_GetDescriptionSize
Upd_Package_GetDisplayName
Upd_Package_GetDisplayNameSize
Upd_Package_GetDownloadEnabled
Upd_Package_GetFeatureCount
Upd_Package_GetFeatureName
Upd_Package_GetFeatureNameSize
Upd_Package_GetFeatureVersion
Upd_Package_GetFeatureVersionSize
Upd_Package_GetFileName
Upd_Package_GetFileNameSize
Upd_Package_GetFileSize
Upd_Package_GetInstallEnabled
Upd_Package_GetIsDownloaded
Upd_Package_GetIsInstalled
Upd_Package_GetIsReadyToDownload
Upd_Package_GetIsReadyToInstall
Upd_Package_GetManifest
Upd_Package_GetName
Upd_Package_GetNameSize
Upd_Package_GetRebootRequired
Upd_Package_GetRequiredPackage
Upd_Package_GetRequiredPackageCount
Upd_Package_GetRevision
Upd_Package_GetRevisionSize
Upd_Package_GetSession
Upd_Package_GetState
Upd_Package_GetUpdatingRestartRequired
Upd_Package_SetDownloadEnabled
Upd_Package_SetInstallEnabled
Upd_PropertyTree_Clear
Upd_PropertyTree_CopyFrom
Upd_PropertyTree_Create
Upd_PropertyTree_CreateChild
Upd_PropertyTree_Destroy
Upd_PropertyTree_FindChild
Upd_PropertyTree_FindItem
Upd_PropertyTree_GetChild
Upd_PropertyTree_GetChildCount
Upd_PropertyTree_GetItemCount
Upd_PropertyTree_GetItemName
Upd_PropertyTree_GetItemNameSize
Upd_PropertyTree_GetItemValue
Upd_PropertyTree_GetItemValueSize
Upd_PropertyTree_GetName
Upd_PropertyTree_GetNameSize
Upd_PropertyTree_GetParent
Upd_PropertyTree_GetSession
Upd_PropertyTree_GetText
Upd_PropertyTree_GetTextSize
Upd_PropertyTree_LoadFromXmlFile
Upd_PropertyTree_LoadFromXmlString
Upd_PropertyTree_RemoveItem
Upd_PropertyTree_RemoveItemAt
Upd_PropertyTree_SaveToXmlFile
Upd_PropertyTree_SetItem
Upd_PropertyTree_SetName
Upd_PropertyTree_SetParent
Upd_PropertyTree_SetText
Upd_Session_ClearError
Upd_Session_Destroy
Upd_Session_GetLastError
Upd_UpdatingSession_AttachDownloadingProgressCallback
Upd_UpdatingSession_AttachInstallationCallback
Upd_UpdatingSession_AttachInstallationProgressCallback
Upd_UpdatingSession_CheckForUpdates
Upd_UpdatingSession_ClearError
Upd_UpdatingSession_Configure
Upd_UpdatingSession_ConfigureFromXmlFile
Upd_UpdatingSession_Create
Upd_UpdatingSession_Destroy
Upd_UpdatingSession_DetachDownloadingProgressCallback
Upd_UpdatingSession_DetachInstallationCallback
Upd_UpdatingSession_DetachInstallationProgressCallback
Upd_UpdatingSession_DownloadUpdates
Upd_UpdatingSession_GetLastError
Upd_UpdatingSession_GetPackage
Upd_UpdatingSession_GetPackageCount
Upd_UpdatingSession_InstallUpdates
Upd_UpdatingSession_RegisterInstalledPackage
Upd_UpdatingSession_SetProxyServer
Upd_UpdatingSession_Update

Sections

.text
Size: 568KB - Virtual size: 567KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 128KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 476KB - Virtual size: 474KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8283bd43c9d87e9d4a0607ad4fb52e69

Headers

File Characteristics

Imports

msvcrt

kernel32

oleaut32

wsock32

winmm

advapi32

user32

gdi32

Exports

Exports

Sections

.text Size: 568KB - Virtual size: 567KB

.rdata Size: 128KB - Virtual size: 125KB

.data Size: 64KB - Virtual size: 71KB

.rsrc Size: 476KB - Virtual size: 474KB

.reloc Size: 40KB - Virtual size: 36KB

.text
Size: 568KB - Virtual size: 567KB

.rdata
Size: 128KB - Virtual size: 125KB

.data
Size: 64KB - Virtual size: 71KB

.rsrc
Size: 476KB - Virtual size: 474KB

.reloc
Size: 40KB - Virtual size: 36KB