Malformed[.]BSoD[.]exe

Resubmissions

23/07/2024, 13:32

240723-qs5f5svhqe 3

23/07/2024, 12:48

240723-p1th6szhlp 3

Sharing

Copy URL Twitter E-mail

General

Target

Malformed.BSoD.exe
Size

54.2MB
MD5

61763d3cf439f9d5e6077c73a40b33f1
SHA1

d5b8b0f3850d76a4ea09af155f9161e89bd44836
SHA256

5a626e9585711c21e7a6e9cf6e936b8bb89b14a1dffef9e66d5aaac675545e2a
SHA512

48477bab6c2148b581eb6787010bd325baca036bc46cb97faafd7999921ac57909d30b43d765c467005f63a1e3168cef89a37ec262919e909b50a22847691af1
SSDEEP

393216:woqPgQWsgDWXoiSYqrtr3rArbrFrir1rPLj3Q7Rt9wlRwq0wBRUVMFgA07yIdWrW:IesobiSYr9wlRJtR7qPw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Malformed.BSoD.exe

Files

Malformed.BSoD.exe
.exe windows:6 windows x64 arch:x64

75be026dd4dbb912d872efdc04ba9325

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

malformed.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress
WakeByAddressAll
WakeByAddressSingle

kernel32

SetThreadPriority
WaitForMultipleObjectsEx
LoadLibraryExA
QueryPerformanceFrequency
QueryPerformanceCounter
RemoveVectoredExceptionHandler
GetModuleHandleW
GetModuleHandleA
AddVectoredExceptionHandler
LoadLibraryExW
GetModuleFileNameW
SetThreadErrorMode
GetConsoleMode
GetCurrentProcessId
GetSystemInfo
GetLogicalProcessorInformationEx
CreateFileW
VirtualQueryEx
GetProcessTimes
GlobalMemoryStatusEx
K32GetPerformanceInfo
OpenProcess
LocalFree
GetSystemTimes
GetProcessIoCounters
ReadProcessMemory
Sleep
SetThreadStackGuarantee
SwitchToThread
CreateWaitableTimerExW
SetWaitableTimer
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
GetCurrentDirectoryW
GetEnvironmentVariableW
SetFileInformationByHandle
GetCurrentProcess
DuplicateHandle
SetFilePointerEx
GetStdHandle
GetSystemTimePreciseAsFileTime
HeapReAlloc
lstrlenW
ReleaseMutex
FindNextFileW
FindClose
GetFileInformationByHandle
GetFileInformationByHandleEx
CreateDirectoryW
FindFirstFileW
DeleteFileW
MoveFileExW
RemoveDirectoryW
WriteConsoleW
CreateThread
GetFullPathNameW
WaitForSingleObjectEx
CreateMutexA
HeapFree
HeapAlloc
GetProcessHeap
FreeLibrary
GetProcAddress
LoadLibraryA
GetCurrentThreadId
FormatMessageW
MultiByteToWideChar
GetCurrentThread
GetLastError
WaitForSingleObject
CreateEventA
IsProcessorFeaturePresent
SetEvent
CloseHandle
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError

user32

GetForegroundWindow
RegisterClassExW
CreateWindowExW
PeekMessageW
DispatchMessageW
TranslateMessage
GetWindowLongPtrW
ChangeDisplaySettingsExW
GetWindowPlacement
SetWindowPlacement
GetSystemMetrics
RegisterTouchWindow
SetWindowDisplayAffinity
GetPropW
CallWindowProcW
SetPropW
RemovePropW
GetMessageW
SetTimer
KillTimer
RegisterWindowMessageA
SetCapture
ReleaseCapture
DestroyIcon
MapVirtualKeyW
EnumDisplayMonitors
MonitorFromPoint
RegisterRawInputDevices
GetRawInputData
SetWindowTextW
GetSystemMenu
EnableMenuItem
SendInput
SetForegroundWindow
GetWindowRect
ShowCursor
GetClipCursor
ClipCursor
InvalidateRgn
IsIconic
SendMessageW
GetAsyncKeyState
GetKeyState
GetKeyboardState
MapVirtualKeyExW
ShowWindow
SetWindowLongW
GetWindowLongW
AdjustWindowRectEx
SystemParametersInfoA
GetKeyboardLayout
IsProcessDPIAware
ToUnicodeEx
RegisterClassExA
DefWindowProcA
CreateWindowExA
GetClientRect
SetCursorPos
ClientToScreen
EnumDisplaySettingsExW
SetWindowPos
MonitorFromWindow
GetCursorPos
TrackMouseEvent
CloseTouchInputHandle
ScreenToClient
GetTouchInputInfo
MonitorFromRect
SetCursor
LoadCursorW
GetMenu
ValidateRect
DefWindowProcW
SetWindowLongPtrW
PostMessageW
RedrawWindow
DestroyWindow
ReleaseDC
GetDC
GetActiveWindow
GetMonitorInfoW

shell32

CommandLineToArgvW
DragFinish
DragQueryFileW

gdi32

GetPixelFormat
SetPixelFormat
SwapBuffers
ChoosePixelFormat
GetDeviceCaps
CreateRectRgn
DescribePixelFormat
DeleteObject

advapi32

CopySid
GetLengthSid
IsValidSid
GetTokenInformation
OpenProcessToken
RegQueryValueExW
RegOpenKeyExW
SystemFunction036
RegCloseKey

ole32

OleInitialize
CoUninitialize
RevokeDragDrop
CoCreateInstance
CoIncrementMTAUsage
RegisterDragDrop
CoInitializeEx
PropVariantClear
CoTaskMemFree

dwmapi

DwmEnableBlurBehindWindow

uiautomationcore

UiaRaiseAutomationEvent
UiaHostProviderFromHwnd
UiaRaiseAutomationPropertyChangedEvent
UiaGetReservedNotSupportedValue
UiaLookupId
UiaReturnRawElementProvider

oleaut32

SysStringLen
SysFreeString
GetErrorInfo
SafeArrayPutElement
SafeArrayCreateVector
SysAllocStringLen
SetErrorInfo

uxtheme

SetWindowTheme

imm32

ImmGetContext
ImmAssociateContextEx
ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetCompositionStringW

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

opengl32

wglCreateContext
wglDeleteContext
wglMakeCurrent
wglGetProcAddress
wglGetCurrentContext

d3dcompiler_47

D3DCompile

pdh

PdhRemoveCounter
PdhOpenQueryA
PdhCloseQuery
PdhGetFormattedCounterValue
PdhAddEnglishCounterW
PdhCollectQueryData

powrprof

CallNtPowerInformation

ntdll

NtQueryInformationProcess
NtRaiseHardError
RtlGetVersion
NtWriteFile
NtCreateFile
NtReadFile
RtlNtStatusToDosError
NtQuerySystemInformation
RtlAdjustPrivilege

psapi

GetModuleFileNameExW
GetProcessMemoryInfo

bcrypt

BCryptGenRandom

vcruntime140

__C_specific_handler
__current_exception
memcmp
memcpy
__CxxFrameHandler3
memset
memmove
_CxxThrowException
__current_exception_context

api-ms-win-crt-math-l1-1-0

powf
cosf
exp2
log2
roundf
sinf
pow
log10
__setusermatherr
fmod
sin
round
atan2f
acos
atanf
tanf
trunc
fmodf
floorf
expf
atan
ceilf
acosf
logf
ceil
exp2f
fmaf
cos
truncf
floor

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback
_c_exit
_initialize_onexit_table
_seh_filter_exe
_set_app_type
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
terminate
__p___argc
__p___argv
_cexit
_register_onexit_function
_crt_atexit

api-ms-win-crt-string-l1-1-0

wcslen
strlen

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 30.1MB - Virtual size: 30.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22.3MB - Virtual size: 22.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 602KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 410KB - Virtual size: 410KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

75be026dd4dbb912d872efdc04ba9325

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

user32

shell32

gdi32

advapi32

ole32

dwmapi

uiautomationcore

oleaut32

uxtheme

imm32

api-ms-win-core-winrt-l1-1-0

opengl32

d3dcompiler_47

pdh

powrprof

ntdll

psapi

bcrypt

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 30.1MB - Virtual size: 30.1MB

.rdata Size: 22.3MB - Virtual size: 22.3MB

.data Size: 12KB - Virtual size: 602KB

.pdata Size: 1.3MB - Virtual size: 1.3MB

.rsrc Size: 10KB - Virtual size: 9KB

.reloc Size: 410KB - Virtual size: 410KB

.text
Size: 30.1MB - Virtual size: 30.1MB

.rdata
Size: 22.3MB - Virtual size: 22.3MB

.data
Size: 12KB - Virtual size: 602KB

.pdata
Size: 1.3MB - Virtual size: 1.3MB

.rsrc
Size: 10KB - Virtual size: 9KB

.reloc
Size: 410KB - Virtual size: 410KB