bfsvc[.]exe | Triage

Resubmissions

08/08/2024, 03:50

240808-eee4jsygqq 3

08/08/2024, 03:50

240808-edxxzaygpr 3

Sharing

Copy URL

Twitter E-mail

General

Target

bfsvc.exe
Size

94KB
MD5

f923554c095a45861773f229df267d19
SHA1

3cbcf1b65d3357a82435f6353e4cf47472922fb9
SHA256

efdfee7e7515b6da041ea299b07846b5c16710b705d2eb12c2ca12e4412d7629
SHA512

8341cd5fc03f3fbfc09f6823b387f3cc327c247668f5be4f602ebbded82cd5b0af31615d39612240586ed9e40a83a62288402634199e0f061f4c0a2b5850d9c4
SSDEEP

1536:5u8xnvgDmoTZNgbmyQiZicYLrFh0MaI3aM6F//9rGd+vLk4uaezHkXgDkjRT:AYImoT0bmLFh0MaI3aM6FnisyaezGz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bfsvc.exe

Files

bfsvc.exe
.exe windows:10 windows x64 arch:x64

abaedbf95a7b730c5d1e00f894cfcfa7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

bfsvc.pdb

Imports

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
GetTokenInformation
OpenThreadToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
SetThreadToken
DuplicateTokenEx
LookupPrivilegeValueW
GetSecurityDescriptorSacl
AdjustTokenPrivileges
GetSecurityDescriptorDacl
OpenProcessToken
GetSecurityDescriptorGroup
SetNamedSecurityInfoW
GetSecurityDescriptorControl
GetSecurityDescriptorOwner

kernel32

GetStartupInfoW
GetLastError
Sleep
LocalFree
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetVolumeInformationW
FindFirstFileW
HeapFree
SetLastError
FindNextFileW
WriteFile
GetPrivateProfileSectionW
FindClose
GetVolumePathNameW
CreateFileW
GetFileAttributesW
GetVolumeNameForVolumeMountPointW
SetFileAttributesW
CloseHandle
HeapAlloc
GetProcAddress
MoveFileExW
GetProcessHeap
CreateDirectoryW
GetFileSizeEx
DeviceIoControl
UnmapViewOfFile
GetCurrentThread
CreateFileMappingW
MapViewOfFile
GetFullPathNameW
CopyFileExW
DeleteFileW
SetFileInformationByHandle
GetFileInformationByHandle
GetFileInformationByHandleEx
LocalAlloc
FreeLibrary
LoadLibraryExW
FlushFileBuffers
GetModuleHandleW

msvcrt

__iob_func
memcmp
memcpy
_snwscanf_s
wcsstr
wcscmp
wcsnlen
wcschr
fflush
wcsncmp
_wcslwr
swprintf_s
fwprintf
_vsnwprintf_s
wcsrchr
memset
?terminate@@YAXXZ
_commode
_fmode
_wcmdln
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_wcsicmp
_wcsnicmp
_vsnwprintf

rpcrt4

UuidCreate

bcrypt

BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptCreateHash
BCryptHashData
BCryptOpenAlgorithmProvider

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust
WTHelperGetProvSignerFromChain

crypt32

CertGetNameStringW

imagehlp

CheckSumMappedFile

shell32

CommandLineToArgvW

shlwapi

PathRemoveBackslashW

ntdll

NtEnumerateBootEntries
NtQueryDirectoryObject
NtTranslateFilePath
NtQueryBootOptions
NtQueryBootEntryOrder
NtQueryValueKey
NtQuerySymbolicLinkObject
NtOpenKey
NtOpenSymbolicLinkObject
RtlImpersonateSelf
NtOpenThreadTokenEx
NtOpenProcessTokenEx
NtAdjustPrivilegesToken
NtOpenDirectoryObject
RtlFreeHeap
RtlAllocateHeap
NtSetInformationFile
NtQuerySystemEnvironmentValueEx
LdrAccessResource
LdrFindResource_U
NtOpenFile
NtQueryInformationThread
NtQueryInformationFile
RtlImageNtHeader
NtDeviceIoControlFile
NtSetInformationThread
NtReadFile
NtOpenProcess
NtQueryInformationProcess
RtlNtStatusToDosError
NtClose
RtlInitUnicodeString
NtWriteFile
NtQuerySystemInformation
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

Sections

.text
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

abaedbf95a7b730c5d1e00f894cfcfa7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

msvcrt

rpcrt4

bcrypt

wintrust

crypt32

imagehlp

shell32

shlwapi

ntdll

Sections

.text Size: 54KB - Virtual size: 53KB

.rdata Size: 34KB - Virtual size: 33KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 68B

.text
Size: 54KB - Virtual size: 53KB

.rdata
Size: 34KB - Virtual size: 33KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 68B