battkill[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

battkill.zip
Size

1.7MB
MD5

22d6ba78d675211992c264e343495c7a
SHA1

d922d354b94ac54941b79335d5fbb7e3ce4ea3a5
SHA256

5e7dc06e6060e1624ed01d8a8fcf02423a7edf5e026f41ca9b66126c92a47373
SHA512

1b18d3c071b1c6d62c855813ff0314737507510269289c33cc3490ef5d93280dde87f760fe2a8fad8743304f3ec8c206e2eeb30961ec0f75b8892129ce4c7fee
SSDEEP

49152:l3L0W0JBRea9QLOSQ5n8L+5FqOgaBqC0ffOsZgAelPL15:5WBfAOSqnCOzqC0nvZgLZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/battkill/DJIBatteryKiller.exe

Files

battkill.zip
.zip
battkill/DJIBatteryKiller.exe
.exe windows:6 windows x86 arch:x86

0558b2807774719e9a54ab2a7d121820

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\VS\Release\DJIBatteryKiller.pdb

Imports

kernel32

InitializeCriticalSectionAndSpinCount
DecodePointer
OutputDebugStringA
RaiseException
GetLastError
SetLastError
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
DeleteCriticalSection
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
LoadLibraryW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
EnterCriticalSection
GetSystemTimeAsFileTime
GetCurrentThreadId
LeaveCriticalSection
CloseHandle
GetCurrentProcessId
QueryPerformanceCounter
Sleep
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
OutputDebugStringW

user32

MessageBoxA
GetForegroundWindow
UnregisterClassW
UnregisterDeviceNotification
RegisterDeviceNotificationW
MessageBeep

oleaut32

SysFreeString
SysStringByteLen
VariantCopy
SysAllocStringByteLen

api-ms-win-crt-stdio-l1-1-0

fwrite
ftell
fread
feof
fclose
__stdio_common_vswprintf
fseek
_wfopen

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-crt-heap-l1-1-0

free
_recalloc

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_seh_filter_dll
abort
_initialize_narrow_environment
_initialize_onexit_table
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
terminate
_cexit
_configure_narrow_argv
_invalid_parameter_noinfo
_errno
_register_onexit_function

vcruntime140

__std_terminate
__CxxQueryExceptionSize
__std_exception_copy
__FrameUnwindFilter
__CxxExceptionFilter
__CxxRegisterExceptionObject
__CxxDetectRethrow
__CxxFrameHandler3
__std_exception_destroy
_CxxThrowException
_except_handler4_common
__CxxUnregisterExceptionObject
memmove

mfc140u

ord2389
ord2385
ord296
ord2996
ord4815
ord1511
ord2304
ord2477
ord4323
ord1663
ord286
ord290
ord265
ord1045
ord1653

slabhidtosmbus

HidSmbus_Close
HidSmbus_SetTimeouts
HidSmbus_Reset
HidSmbus_SetGpioConfig
HidSmbus_AddressReadRequest
HidSmbus_TransferStatusRequest
HidSmbus_GetTransferStatusResponse
HidSmbus_ForceReadResponse
HidSmbus_GetReadResponse
HidSmbus_WriteRequest
HidSmbus_Open
HidSmbus_GetNumDevices
HidSmbus_GetString
HidSmbus_IsOpened
HidSmbus_GetOpenedAttributes
HidSmbus_GetPartNumber
HidSmbus_GetOpenedString
HidSmbus_SetSmbusConfig
HidSmbus_GetTimeouts
HidSmbus_GetSmbusConfig
HidSmbus_GetHidGuid
HidSmbus_GetAttributes

msvcp140

?__ExceptionPtrCopy@@YAXPAXPBX@Z
?_Xlength_error@std@@YAXPBD@Z
?__ExceptionPtrDestroy@@YAXPAX@Z

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-utility-l1-1-0

rand
srand

mscoree

_CorExeMain

Sections

.text
Size: 260KB - Virtual size: 259KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
battkill/Killer.ini

Sharing

General

Malware Config

Signatures

Files

0558b2807774719e9a54ab2a7d121820

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

oleaut32

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

vcruntime140

mfc140u

slabhidtosmbus

msvcp140

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

mscoree

Sections

.text Size: 260KB - Virtual size: 259KB

.rdata Size: 1.8MB - Virtual size: 1.8MB

.data Size: 2KB - Virtual size: 3KB

.rsrc Size: 1024B - Virtual size: 896B

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 260KB - Virtual size: 259KB

.rdata
Size: 1.8MB - Virtual size: 1.8MB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 1024B - Virtual size: 896B

.reloc
Size: 3KB - Virtual size: 3KB