BurntSushi[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

BurntSushi.exe
Size

8.3MB
MD5

887b877ab4532d4ef947d13a3aef9ec5
SHA1

b1b427b063a63893fa7a4f347e63bd1798284344
SHA256

e6f951016eece124e7ba5957179d07f3420bb2b185d3fdff9fb2a10ed792cadd
SHA512

866d87346b8c710c8f1f1f8558f216d2ef0c2d0409dc6e7cc4d0f902706c83c8faad3f4939c31e843c84fdd380bbe0fa9cc505b224fb407d9b0475dd3024c352
SSDEEP

98304:IkoFkdqXXIGYTLuk9rtleltFg1YGesO+nHYpwgX8+3ZgSvXR:IkeT4rAGeMHRgMGvXR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BurntSushi.exe

Files

BurntSushi.exe
.exe windows:6 windows x64 arch:x64

60787cc32059dfba096eb23d0b43d296

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

BurntSushi.pdb

Imports

api-ms-win-core-synch-l1-2-0

WaitOnAddress
WakeByAddressAll
WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

GetModuleHandleW
QueryPerformanceCounter
HeapReAlloc
AttachConsole
FlushInstructionCache
AllocConsole
GetConsoleWindow
GetModuleFileNameW
lstrlenW
OpenProcess
DuplicateHandle
AddVectoredExceptionHandler
SetThreadStackGuarantee
QueryFullProcessImageNameW
SetLastError
Thread32Next
Thread32First
CreateToolhelp32Snapshot
GetStdHandle
GetConsoleMode
GetFileInformationByHandleEx
SetConsoleCtrlHandler
SetConsoleCursorPosition
FillConsoleOutputCharacterA
FillConsoleOutputAttribute
SetConsoleMode
ReleaseSemaphore
GetProcAddress
GetSystemWow64DirectoryW
CreateSemaphoreA
GetSystemInfo
VirtualAllocEx
ReadProcessMemory
WriteProcessMemory
VirtualFreeEx
SwitchToThread
GetSystemTimeAsFileTime
InitializeSListHead
GetQueuedCompletionStatusEx
ReleaseMutex
IsDebuggerPresent
CreateMutexW
CreateIoCompletionPort
SetFileCompletionNotificationModes
MoveFileExW
CopyFileExW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CreateProcessW
SetHandleInformation
CreatePipe
VirtualQueryEx
GetExitCodeProcess
IsWow64Process
GetSystemWow64DirectoryA
GetExitCodeThread
WaitForSingleObject
GetCurrentThreadId
CreateRemoteThread
GetProcessId
GetCurrentProcess
LocalFree
GetTempPathW
GetTempFileNameW
CreateActCtxW
ActivateActCtx
GetCurrentThread
FreeLibrary
SetFileInformationByHandle
SetFilePointerEx
GetTimeZoneInformationForYear
DeviceIoControl
GetSystemTimePreciseAsFileTime
PostQueuedCompletionStatus
GetLastError
TerminateProcess
GetCommandLineW
GetVolumeInformationW
DeleteFileW
CreateProcessA
ExitProcess
MultiByteToWideChar
WriteConsoleW
GetModuleHandleA
QueryPerformanceFrequency
FormatMessageW
GetCurrentDirectoryW
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcessId
CreateMutexA
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
GetEnvironmentVariableW
CreateFileW
GetFileInformationByHandle
GetFullPathNameW
GetFinalPathNameByHandleW
CreateDirectoryW
FindFirstFileW
FindClose
GetDriveTypeW
GetDiskFreeSpaceExW
GetLogicalDrives
FreeConsole
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
GetFileAttributesW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
HeapAlloc
GetProcessHeap
CloseHandle
GetProcessTimes
GetSystemTimes
GetProcessIoCounters
GetTickCount64
GlobalMemoryStatusEx
HeapFree
GetConsoleScreenBufferInfo
IsProcessorFeaturePresent

advapi32

RegQueryValueExW
RegOpenKeyExW
GetTokenInformation
CopySid
LookupAccountSidW
GetNamedSecurityInfoW
IsValidSid
GetSidIdentifierAuthority
ImpersonateSelf
OpenProcessToken
OpenThreadToken
RevertToSelf
SystemFunction036
AccessCheck
RegCloseKey
GetLengthSid
MapGenericMask

ws2_32

WSAIoctl
bind
getsockname
WSACleanup
setsockopt
WSAGetLastError
getsockopt
connect
WSASocketW
socket
WSAStartup
freeaddrinfo
shutdown
WSASend
getpeername
recv
send
closesocket
ioctlsocket
getaddrinfo

user32

GetCursorPos
SetMenuItemInfoW
RegisterClassExW
SetForegroundWindow
LoadCursorW
DeleteMenu
DestroyMenu
GetParent
DrawMenuBar
SetMenu
CreateMenu
SetParent
SetMenuInfo
CreatePopupMenu
GetMenuItemCount
AppendMenuW
DefWindowProcW
ShowWindow
TrackPopupMenu
GetSubMenu
GetMenuItemID
DestroyIcon
PostMessageW
EnumThreadWindows
EnumChildWindows
GetWindowThreadProcessId
PostThreadMessageW
LoadImageW
CheckMenuItem
GetClassNameW
GetWindowTextW
GetWindowTextLengthW
CreateWindowExW
GetMenu
UnhookWinEvent
DestroyWindow
MsgWaitForMultipleObjects
PeekMessageW
CreateWindowExA
SetWinEventHook
DispatchMessageW
TranslateMessage
IsDialogMessageW
GetAncestor
GetMessageW
SendMessageW

shell32

Shell_NotifyIconW
SHGetKnownFolderPath
ShellExecuteW
CommandLineToArgvW
DragFinish

comctl32

InitCommonControlsEx
SetWindowSubclass
GetWindowSubclass
RemoveWindowSubclass
DefSubclassProc

ole32

CoTaskMemFree
CoInitializeSecurity
CoUninitialize
CoInitializeEx
CoSetProxyBlanket
CoCreateInstance
CoInitialize

ntdll

RtlNtStatusToDosError
NtCreateFile
NtDeviceIoControlFile
NtQueryInformationProcess
NtCancelIoFileEx
NtWriteFile
NtQuerySystemInformation
RtlGetVersion
NtReadFile

bcrypt

BCryptGenRandom

pdh

PdhCollectQueryData
PdhRemoveCounter
PdhOpenQueryA
PdhCloseQuery
PdhGetFormattedCounterValue
PdhAddEnglishCounterW

iphlpapi

GetAdaptersAddresses
GetIfEntry2
FreeMibTable
GetIfTable2

netapi32

NetApiBufferFree
NetUserGetLocalGroups
NetUserGetInfo
NetUserEnum

secur32

LsaFreeReturnBuffer
LsaEnumerateLogonSessions
LsaGetLogonSessionData

powrprof

CallNtPowerInformation

oleaut32

VariantClear
SetErrorInfo
GetErrorInfo
SysStringLen
SysFreeString
SysAllocString

psapi

GetModuleBaseNameW
EnumProcessModulesEx
GetModuleFileNameExW
GetPerformanceInfo

vcruntime140

memmove
memcmp
memcpy
__CxxFrameHandler3
__current_exception_context
__current_exception
_CxxThrowException
memset
__C_specific_handler

api-ms-win-crt-math-l1-1-0

truncf
ceil
trunc
round
pow
__setusermatherr

api-ms-win-crt-convert-l1-1-0

_wtoi64

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode
realloc

api-ms-win-crt-runtime-l1-1-0

__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_configure_narrow_argv
terminate
_crt_atexit
_seh_filter_exe
_initialize_narrow_environment
_set_app_type
_initialize_onexit_table
_register_onexit_function
__p___argc

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 4.3MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 183KB - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 421KB - Virtual size: 420KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

60787cc32059dfba096eb23d0b43d296

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

advapi32

ws2_32

user32

shell32

comctl32

ole32

ntdll

bcrypt

pdh

iphlpapi

netapi32

secur32

powrprof

oleaut32

psapi

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 4.3MB - Virtual size: 4.3MB

.rdata Size: 3.4MB - Virtual size: 3.4MB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 183KB - Virtual size: 183KB

.rsrc Size: 421KB - Virtual size: 420KB

.reloc Size: 17KB - Virtual size: 16KB

.text
Size: 4.3MB - Virtual size: 4.3MB

.rdata
Size: 3.4MB - Virtual size: 3.4MB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 183KB - Virtual size: 183KB

.rsrc
Size: 421KB - Virtual size: 420KB

.reloc
Size: 17KB - Virtual size: 16KB