B2N9U[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

B2N9U.exe
Size

19.1MB
MD5

201942fc7d5eb590c6cdd4dd350fa401
SHA1

c2053edc612a8105ee2b88337197c4854782d830
SHA256

2c77633e5f38f1daef16af96da14bed9a9e26ad0d268e10765131b7964074d46
SHA512

acdba1f504658743bba5006054ad95bde98148fbebe8bb0eba76238033a99a2e22f1e1dc562615519e9e6579f0e70a471d7fcdc2f73c2b96054cc0730f7fa8d5
SSDEEP

393216:CV5uko3XwuXUOjgjlcoFCH2ooPgnnwJUUfYCSDNUKQH2Sy6vfNIf8iEj0f6p1nDU:CvelUXcoF+2HPgnnKdSDNUKdmIf8Sfie

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
B2N9U.exe

Files

B2N9U.exe
.exe windows:6 windows x64 arch:x64

0eda12d1d9d83323d4da183f17ee97eb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ole32

CoCreateInstance

oleaut32

SysAllocString

kernel32

CheckRemoteDebuggerPresent
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress

shell32

ShellExecuteW

user32

BlockInput

advapi32

GetTokenInformation

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ

ws2_32

WSACleanup

urlmon

URLDownloadToFileW

ntdll

NtQuerySystemInformation

vcruntime140

_CxxThrowException

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func

api-ms-win-crt-heap-l1-1-0

_aligned_free

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-runtime-l1-1-0

__p___argc

api-ms-win-crt-time-l1-1-0

_localtime64

api-ms-win-crt-filesystem-l1-1-0

_lock_file

api-ms-win-crt-string-l1-1-0

_strdup

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-convert-l1-1-0

strtod

Sections

��끫9{
Size: - Virtual size: 406KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

��M��
Size: - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

!�%�0= �
Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

r�S�A
Size: - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

�oX�B*�
Size: - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

�eho$C��
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

u�-F��
Size: - Virtual size: 38B

sQ��jTfu
Size: - Virtual size: 11.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

��^��?�L
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

A=�\X�u
Size: 19.1MB - Virtual size: 19.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

*��h
Size: 512B - Virtual size: 280B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Vv��
Size: 512B - Virtual size: 422B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0eda12d1d9d83323d4da183f17ee97eb

Headers

DLL Characteristics

File Characteristics

Imports

ole32

oleaut32

kernel32

shell32

user32

advapi32

msvcp140

ws2_32

urlmon

ntdll

vcruntime140

vcruntime140_1

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

Sections

��끫9{ Size: - Virtual size: 406KB

���M��� Size: - Virtual size: 188KB

!�%�0= � Size: - Virtual size: 1.1MB

r�S�A Size: - Virtual size: 18KB

�oX�B*� Size: - Virtual size: 40B

�eho$C�� Size: - Virtual size: 4KB

u�-F�� Size: - Virtual size: 38B

sQ��jTfu Size: - Virtual size: 11.8MB

��^��?�L Size: 9KB - Virtual size: 8KB

A=�\X�u Size: 19.1MB - Virtual size: 19.1MB

*���h Size: 512B - Virtual size: 280B

Vv���� Size: 512B - Virtual size: 422B

��끫9{
Size: - Virtual size: 406KB

��M��
Size: - Virtual size: 188KB

!�%�0= �
Size: - Virtual size: 1.1MB

r�S�A
Size: - Virtual size: 18KB

�oX�B*�
Size: - Virtual size: 40B

�eho$C��
Size: - Virtual size: 4KB

u�-F��
Size: - Virtual size: 38B

sQ��jTfu
Size: - Virtual size: 11.8MB

��^��?�L
Size: 9KB - Virtual size: 8KB

A=�\X�u
Size: 19.1MB - Virtual size: 19.1MB

*��h
Size: 512B - Virtual size: 280B

Vv��
Size: 512B - Virtual size: 422B