BitLockerDeviceEncryption[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

BitLockerDeviceEncryption.exe
Size

174KB
MD5

a82ca1393ab8e49439059de1159ddc6d
SHA1

80b5a05f5e8a634497622daee1fd2e276c869348
SHA256

197d19774ad078073c13eb35a65f1cfd316dc7781115d41d86f086c13dabf218
SHA512

9136c3f60a8aed7e83f7cfc9324dd52f419102d88264836532f1d171aefb0d4e366ff48dcca0fac3a332e789bdc40d0b8977a6cbc408344ab9fa5fc2cbdaf4f6
SSDEEP

3072:18UvPv2NJ1bzkFyENMt5wtUd8yuiKGLEj+RNvkJTTik7SK4:1Jv2RiyENM/Sm8yuiKGLyyY+k7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BitLockerDeviceEncryption.exe

Files

BitLockerDeviceEncryption.exe
.exe windows:10 windows x64 arch:x64

b0c741b9a80192773e9b71b2335b5e9e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

BitLockerDeviceEncryption.pdb

Imports

advapi32

TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
EventWriteTransfer
RegCloseKey
RegGetValueW
RegGetValueA
RegEnumValueW
RegQueryInfoKeyW
RegEnumKeyExW
EventSetInformation
EventRegister
EventUnregister
RegCreateKeyExW
RegSetKeyValueW
RegSetValueExW
LsaOpenPolicy
LsaQueryInformationPolicy
LsaFreeMemory
LsaClose
RegDeleteTreeW
EventProviderEnabled
RegOpenKeyExW

kernel32

InitializeCriticalSectionEx
GetProcAddress
FreeLibrary
HeapAlloc
HeapFree
CloseHandle
GetVolumePathNameW
SetEvent
CreateEventW
RaiseException
IsDebuggerPresent
SetThreadpoolTimer
FormatMessageW
LocalFree
GetProcessMitigationPolicy
WaitForSingleObjectEx
GetModuleHandleExW
SetLastError
DeleteCriticalSection
WaitForSingleObject
OpenSemaphoreW
CreateThreadpoolTimer
CreateMutexExW
LeaveCriticalSection
ReleaseMutex
ReleaseSemaphore
CreateSemaphoreExW
DelayLoadFailureHook
ReleaseSRWLockShared
AcquireSRWLockShared
OutputDebugStringW
ResolveDelayLoadedAPI
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
LocalAlloc
GetModuleFileNameA
GetVolumePathNamesForVolumeNameW
EnterCriticalSection
CloseThreadpoolTimer
GetModuleFileNameW
WaitForThreadpoolTimerCallbacks
GetProcessHeap
GetLastError
HeapSetInformation
HeapSize
CompareStringOrdinal
MultiByteToWideChar
DebugBreak

msvcrt

memmove_s
memcpy_s
_XcptFilter
_amsg_exit
__wgetmainargs
__set_app_type
exit
memcmp
toupper
wcschr
wcstoul
memset
_stricmp
??1type_info@@UEAA@XZ
memmove
memcpy
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_callnewh
malloc
_purecall
??3@YAXPEAX@Z
__CxxFrameHandler3
_vsnwprintf
iswascii
_exit
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_commode
_fmode
__C_specific_handler
_initterm
__setusermatherr
_cexit
wcscmp

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

fveskybackup

FveBackupRecoveryPasswordToCloudDomain
FveBackupRecoveryPasswordToSkyDrive

api-ms-win-core-com-l1-1-0

CoInitializeEx
CLSIDFromString
CoWaitForMultipleHandles
CoUninitialize

fveapi

FveIsBoundDataVolumeToOSVolume
FveSetAllowKeyExport
FveIsDeviceLockedOut
FveGetSecureBootBindingState
FveBackupRecoveryInformationToADEx
FveGetVolumeNameW
FveGetIdentity
FveCommitChanges
FveGetAuthMethodInformation
FveAddAuthMethodInformation
FveDeleteAuthMethod
FveGetStatus
FveCloseVolume
FveOpenVolumeW
FveSelectBestRecoveryPasswordByBackupInformation
FveBindDataVolume
FveCheckTpmCapability

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

dsreg

DsrFreeJoinInfoEx
DsrGetJoinInfoEx

bcrypt

BCryptHashData
BCryptFinishHash
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptOpenAlgorithmProvider

ntdll

RtlFreeUnicodeString
RtlStringFromGUID
NtPowerInformation
RtlNtStatusToDosError
NtQuerySystemInformation

Sections

.text
Size: 129KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 776B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b0c741b9a80192773e9b71b2335b5e9e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

msvcrt

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

fveskybackup

api-ms-win-core-com-l1-1-0

fveapi

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

dsreg

bcrypt

ntdll

Sections

.text Size: 129KB - Virtual size: 128KB

.rdata Size: 35KB - Virtual size: 35KB

.data Size: 1KB - Virtual size: 3KB

.pdata Size: 3KB - Virtual size: 3KB

.didat Size: 512B - Virtual size: 48B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 1024B - Virtual size: 776B

.text
Size: 129KB - Virtual size: 128KB

.rdata
Size: 35KB - Virtual size: 35KB

.data
Size: 1KB - Virtual size: 3KB

.pdata
Size: 3KB - Virtual size: 3KB

.didat
Size: 512B - Virtual size: 48B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 1024B - Virtual size: 776B