Bully[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Bully.exe
Size

7.8MB
MD5

05fd0e16d4f3b1054f87121b0dd175f0
SHA1

707ca056621d072c9c8aaacf55a5af0f4d8a209c
SHA256

3f8565f37e5a70036127fa688b08d1b404ca231c74886f455b0b2e69705bef80
SHA512

d92675bd73c99c5ea4f32921593721743db7437c12675d901756f7070102a6720963fdff0d7bb3c681d81a3f195aa62c8e07d3df30f249723c34784c2d9af373
SSDEEP

196608:ggS4ys4CJASPUSR+8yA7mzud8+mSUTDuX:gGASPUSR+8n7mzuAS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Bully.exe

Files

Bully.exe
.exe windows:4 windows x86 arch:x86

8ed1f4cde4daa35c8467aca0d08bbb25

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ddraw

DirectDrawCreateEx

xinput1_3

ord4
ord3
ord2

kernel32

GlobalMemoryStatus
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
ReleaseMutex
CloseHandle
SuspendThread
ResumeThread
DebugBreak
GetLastError
CreateFileA
SetFilePointer
ReadFile
WriteFile
MultiByteToWideChar
GetTickCount
GetModuleFileNameA
GetLocalTime
InitializeCriticalSection
DeleteCriticalSection
CreateEventA
GetOverlappedResult
DeleteFileA
GetFileSize
LocalFree
ReleaseSemaphore
WaitForMultipleObjects
SetLastError
SetThreadPriority
CreateThread
CreateMutexA
LocalAlloc
CreateSemaphoreA
FreeLibrary
GetProcAddress
LoadLibraryA
FindClose
FindNextFileA
GetFileAttributesA
FindFirstFileA
CreateDirectoryA
GetCommandLineA
GetSystemInfo
GetVersionExA
lstrlenA
WideCharToMultiByte
OutputDebugStringA
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetEnvironmentVariableA
GetStringTypeW
GetStringTypeA
FlushFileBuffers
SetStdHandle
GetLocaleInfoA
GetCurrentDirectoryA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
CompareStringW
CompareStringA
LCMapStringW
LCMapStringA
GetConsoleMode
GetConsoleCP
VirtualQuery
HeapCreate
HeapDestroy
VirtualAlloc
VirtualFree
GetModuleHandleA
Sleep
InterlockedDecrement
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
InterlockedExchange
HeapSize
GetFileType
SetHandleCount
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStdHandle
HeapReAlloc
GetFullPathNameA
GetDriveTypeA
GetStartupInfoA
GetProcessHeap
HeapFree
HeapAlloc
RtlUnwind
RaiseException
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
ExitProcess

user32

ChangeDisplaySettingsA
TranslateMessage
DispatchMessageA
PeekMessageA
GetMonitorInfoA
MoveWindow
ShowWindow
SetWindowPos
GetClientRect
SystemParametersInfoA
MessageBoxW
mouse_event
LoadIconA
MessageBoxA
ShowCursor
PostQuitMessage
DefWindowProcA
PostMessageA
GetCursorPos
LoadCursorA
RegisterClassA
TranslateAcceleratorA
GetWindowRect
IsWindow
SendMessageA
SetWindowTextA
CreateWindowExA
AdjustWindowRect
wsprintfW
DestroyWindow
SendDlgItemMessageA
CheckDlgButton
ScreenToClient
GetWindowLongA
DialogBoxIndirectParamA
EndDialog
UpdateWindow

gdi32

GetStockObject

advapi32

RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegOpenKeyA
RegCreateKeyExA
RegCloseKey

shell32

SHGetFolderPathA

ole32

CoInitializeEx
CoCreateInstance
CoSetProxyBlanket
CoTaskMemFree
CoInitialize
CoUninitialize

oleaut32

SysAllocString
SysFreeString

d3dx9_38

D3DXAssembleShader
D3DXAssembleShaderFromFileA
D3DXCompileShaderFromFileA
D3DXGetShaderConstantTable
D3DXGetImageInfoFromFileInMemory
D3DXCreateTextureFromFileInMemory
D3DXCreateEffectCompiler
D3DXVec3Normalize
D3DXVec4Transform
D3DXMatrixReflect
D3DXCreateTexture
D3DXLoadSurfaceFromSurface
D3DXMatrixMultiply
D3DXCreateEffect
D3DXMatrixTranspose
D3DXCompileShader
D3DXGetShaderInputSemantics
D3DXCreateTextureFromFileExA
D3DXCreateVolumeTextureFromFileExA
D3DXCreateCubeTextureFromFileExA
D3DXMatrixInverse
D3DXGetShaderVersion
D3DXCreateCubeTextureFromFileInMemory
D3DXCreateVolumeTextureFromFileInMemory
D3DXGetVertexShaderProfile
D3DXGetPixelShaderProfile
D3DXCreateBuffer
D3DXSaveSurfaceToFileA

vcomp

_vcomp_for_static_simple_init
_vcomp_fork
_vcomp_for_static_end

comctl32

InitCommonControlsEx

dinput8

DirectInput8Create

Sections

.text
Size: 5.0MB - Virtual size: 5.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 800KB - Virtual size: 798KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.0MB - Virtual size: 23.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8ed1f4cde4daa35c8467aca0d08bbb25

Headers

File Characteristics

Imports

ddraw

xinput1_3

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

d3dx9_38

vcomp

comctl32

dinput8

Sections

.text Size: 5.0MB - Virtual size: 5.0MB

.rdata Size: 800KB - Virtual size: 798KB

.data Size: 2.0MB - Virtual size: 23.2MB

.rsrc Size: 28KB - Virtual size: 25KB

.text
Size: 5.0MB - Virtual size: 5.0MB

.rdata
Size: 800KB - Virtual size: 798KB

.data
Size: 2.0MB - Virtual size: 23.2MB

.rsrc
Size: 28KB - Virtual size: 25KB