2024-08-31_b1deb6df5c05c672790038cd947d7c85_bkransomware_floxif_hijackloader

Sharing

Copy URL Twitter E-mail

General

Target
2024-08-31_b1deb6df5c05c672790038cd947d7c85_bkransomware_floxif_hijackloader
Size 2.0MB
Sample240831-b6g6fayelf
SHA256 d3071643080dbeff15c828403900fa0f97eb73f28fa9edc4aa277b5dca9d0a3b
MD5 b1deb6df5c05c672790038cd947d7c85
SHA1 3ac2c5df37c289ab455ae722b0e3c68da5183dd1
SHA512 80b0cb5fc8f9eaa4e644c0fc14d2bc5b2ed32e998f4c83aa76350f66a6dc5d6e464a1d0b4744a5d442239761f86460d7a2c32273252a9e38c84d443e8a28a00d
SSDEEP 49152:Dk0eo5nJIioHlq+c6gXR92IISNbecXxHDJhf3M7sSZOZVVNa6Z2:Dk25nHoHlq+c6y92IBRecXxH9hf3M7su
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

2024-08-31_b1deb6df5c05c672790038cd947d7c85_bkransomware_floxif_hijackloader

.exe 2.0MB

2024-08-31_b1deb6df5c05c672790038cd947d7c85_bkransomware_floxif_hijackloader

IMPHASH c5b6a202b57a8452be9c90f3cc9d8d2b
SHA256 d3071643080dbeff15c828403900fa0f97eb73f28fa9edc4aa277b5dca9d0a3b
MD5 b1deb6df5c05c672790038cd947d7c85
SHA1 3ac2c5df37c289ab455ae722b0e3c68da5183dd1
SHA512 80b0cb5fc8f9eaa4e644c0fc14d2bc5b2ed32e998f4c83aa76350f66a6dc5d6e464a1d0b4744a5d442239761f86460d7a2c32273252a9e38c84d443e8a28a00d
SSDEEP 49152:Dk0eo5nJIioHlq+c6gXR92IISNbecXxHDJhf3M7sSZOZVVNa6Z2:Dk25nHoHlq+c6y92IBRecXxH9hf3M7su
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

da:8d:e9:d0:62:36:92:51:20:4d:7a:d2:68:ac:79:f7:5f:12:f9:7c:e7:73:22:7f:36:20:91:78:7f:db:a1:b3

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=110111-0725064,CN=HANCOM. INC\,,O=HANCOM. INC\,,L=Seongnam-si,ST=Gyeonggi-do,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130b53656f6e676e616d2d7369,1.3.6.1.4.1.311.60.2.1.2=#130b4779656f6e6767692d646f,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Chains

Nov 6, 2023

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

07:7d:2b:6a:b3:ae:1c:4d:9e:62:4e:c8:66:41:c0:11

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 26, 2023 - Sep 29, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1219919

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\HOffice130\install\Installer\Setup\Release_KOR\Setup_KOR.pdb

kernel32

OutputDebugStringW GetTimeZoneInformation GetStringTypeW SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleCP GetCPInfo GetOEMCP GetACP IsValidCodePage TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter FreeEnvironmentStringsW GetEnvironmentStringsW GetStartupInfoW GetStdHandle GetSystemTimeAsFileTime SizeofResource VirtualQuery VirtualAlloc GetSystemInfo HeapQueryInformation GetFileType SetStdHandle ExitThread CreateThread RtlUnwind IsProcessorFeaturePresent IsDebuggerPresent GetModuleHandleExW ExitProcess GetCommandLineW WriteConsoleW QueryPerformanceCounter SetEnvironmentVariableA FindResourceExW VirtualProtect GetProfileIntW GetTickCount GetTempPathW GetTempFileNameW SearchPathW SetErrorMode GetWindowsDirectoryW GetFileTime GetFileSizeEx GetFileAttributesExW FileTimeToLocalFileTime lstrcmpiW DuplicateHandle WriteFile UnlockFile SetFilePointer SetEndOfFile ReadFile LockFile GetVolumeInformationW GetFullPathNameW FlushFileBuffers FindClose GetFileSize CreateFileW VerifyVersionInfoW VerSetConditionMask DeleteFileW GetCurrentDirectoryW LCMapStringW GetUserDefaultUILanguage GetSystemDefaultUILanguage GetLocaleInfoW CompareStringW FileTimeToSystemTime GlobalGetAtomNameW LocalReAlloc LocalAlloc GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSection GlobalFlags ResumeThread SetThreadPriority CompareStringA lstrcmpA GetVersionExW GetCurrentThread GlobalFindAtomW GlobalAddAtomW LoadLibraryA lstrcmpW GlobalDeleteAtom LoadLibraryExW FreeLibrary GetCurrentThreadId EncodePointer CopyFileW GlobalSize GlobalAlloc GetCurrentProcessId MulDiv LoadLibraryW GlobalFree GlobalUnlock GlobalLock GetModuleHandleW FreeResource SetLastError OutputDebugStringA DeleteCriticalSection DecodePointer EnterCriticalSection HeapSize RaiseException LeaveCriticalSection InitializeCriticalSectionAndSpinCount GetProcessHeap HeapFree HeapAlloc HeapReAlloc GetLocalTime GetFileAttributesW GetSystemDirectoryW CloseHandle GetUserDefaultLCID GetModuleHandleA GetProcAddress GetCurrentProcess GetExitCodeProcess GetPrivateProfileIntW GetPrivateProfileStringW WritePrivateProfileStringW GetModuleFileNameW Process32NextW Process32FirstW CreateToolhelp32Snapshot Sleep WaitForSingleObject WinExec FindFirstFileW SetThreadUILanguage lstrcpyW LocalFree FormatMessageW GetLastError MultiByteToWideChar WideCharToMultiByte FindResourceW LoadResource LockResource

user32

CharUpperBuffW SetCursorPos DrawFrameControl DrawEdge SetRect UnionRect GetKeyNameTextW InvertRect HideCaret EnableScrollBar GetIconInfo DrawIconEx DrawFocusRect GetNextDlgGroupItem GetMenuDefaultItem SetClassLongW LockWindowUpdate RegisterClipboardFormatW EnumChildWindows CopyAcceleratorTableW DestroyAcceleratorTable CreateAcceleratorTableW MapVirtualKeyW GetKeyboardState GetKeyboardLayout ToUnicodeEx WaitMessage PostThreadMessageW ModifyMenuW IsMenu NotifyWinEvent WindowFromPoint SetWindowRgn GetSystemMenu SetCapture GetAsyncKeyState CharUpperW TrackMouseEvent IsRectEmpty DrawStateW EmptyClipboard SetClipboardData CloseClipboard OpenClipboard EnumDisplayMonitors SetLayeredWindowAttributes MonitorFromPoint SetParent ReuseDDElParam UnpackDDElParam LoadImageW DestroyIcon SetRectEmpty InsertMenuItemW CreatePopupMenu LoadAcceleratorsW ReleaseCapture BringWindowToTop InvalidateRect KillTimer SetTimer DeleteMenu CopyImage GetMenuItemInfoW DestroyMenu LoadCursorW GetSysColorBrush IntersectRect InflateRect RealChildWindowFromPoint SetCursor ShowOwnedPopups GetCursorPos GetMessageW OffsetRect MessageBeep IsZoomed PostQuitMessage SendDlgItemMessageA LoadBitmapW UpdateLayeredWindow GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem IsDialogMessageW SetWindowTextW SendDlgItemMessageW CheckDlgButton MoveWindow ShowWindow GetMonitorInfoW MonitorFromWindow WinHelpW GetScrollInfo SetScrollInfo CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetWindow GetTopWindow GetClassNameW GetClassLongW SetWindowLongW PtInRect EqualRect CopyRect MapWindowPoints AdjustWindowRectEx GetWindowTextLengthW GetWindowTextW RemovePropW GetPropW SetPropW ShowScrollBar GetScrollRange SetScrollRange GetScrollPos SetScrollPos ScrollWindow RedrawWindow ValidateRect SetForegroundWindow GetForegroundWindow UpdateWindow TrackPopupMenu SetMenu GetMenu GetCapture GetKeyState GetFocus SetFocus GetDlgCtrlID IsWindowVisible EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPlacement GetWindowPlacement SetWindowPos IsChild CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW DefWindowProcW PostMessageW GetMessageTime GetMessagePos RegisterWindowMessageW GetWindowRect LoadMenuW RemoveMenu AppendMenuW InsertMenuW SetMenuDefaultItem CopyIcon FrameRect IsClipboardFormatAvailable DrawMenuBar DefFrameProcW DefMDIChildProcW TranslateMDISysAccel IsCharLowerW MapVirtualKeyExW SubtractRect GetUpdateRect GetComboBoxInfo GetDoubleClickTime CreateMenu GetWindowRgn MapDialogRect SetMenuItemInfoW DestroyCursor GetMenuItemCount GetMenuItemID GetSubMenu GetMenuState GetMenuStringW GetLastActivePopup GetWindowThreadProcessId FillRect GetSysColor ScreenToClient ClientToScreen EndPaint BeginPaint ReleaseDC GetWindowDC GetDC TabbedTextOutW GrayStringW DrawTextExW DrawTextW GetParent GetDesktopWindow GetWindowLongW SetActiveWindow IsWindowEnabled GetActiveWindow GetNextDlgTabItem GetDlgItem EndDialog CreateDialogIndirectParamW DestroyWindow IsWindow UnregisterClassW ExitWindowsEx DispatchMessageW TranslateMessage PeekMessageW MessageBoxW DrawIcon GetClientRect GetSystemMetrics IsIconic SendMessageW SystemParametersInfoW LoadIconW EnableWindow TranslateAcceleratorW

gdi32

DPtoLP CreateCompatibleBitmap CreateDIBitmap EnumFontFamiliesW GetTextCharsetInfo GetDIBits RealizePalette SetPixel StretchBlt CreateDIBSection SetDIBColorTable CreateRoundRectRgn GetRgnBox OffsetRgn GetTextColor CreatePalette GetNearestPaletteIndex GetPaletteEntries GetSystemPaletteEntries GetBkColor CreateEllipticRgn Ellipse CreatePolygonRgn Polygon Polyline Rectangle SetRectRgn ExtFloodFill SetPaletteEntries GetViewportOrgEx LPtoDP GetWindowOrgEx FillRgn FrameRgn GetBoundsRect PtInRegion GetTextFaceW SetPixelV SetROP2 SetPolyFillMode PatBlt CreateRectRgnIndirect CombineRgn GetTextMetricsW GetTextExtentPoint32W CreateDCW CopyMetaFileW SetTextColor ScaleWindowExtEx ScaleViewportExtEx OffsetWindowOrgEx OffsetViewportOrgEx SetWindowOrgEx SetWindowExtEx SetViewportOrgEx SetViewportExtEx ExtTextOutW TextOutW MoveToEx RoundRect CreateSolidBrush GetLayout SetLayout SetMapMode SetBkMode SetBkColor SelectPalette SelectObject ExtSelectClipRgn SelectClipRgn SaveDC RestoreDC RectVisible PtVisible LineTo IntersectClipRect GetWindowExtEx GetViewportExtEx GetPixel GetObjectType GetDeviceCaps GetClipBox ExcludeClipRect Escape DeleteObject CreateRectRgn CreatePatternBrush CreatePen CreateHatchBrush CreateBitmap BitBlt DeleteDC EnumFontFamiliesExW CreateCompatibleDC CreateFontIndirectW GetObjectW GetStockObject SetTextAlign

msimg32

AlphaBlend TransparentBlt

winspool.drv

ClosePrinter OpenPrinterW DocumentPropertiesW

advapi32

RegEnumKeyExW RegEnumValueW RegQueryValueW RegEnumKeyW RegCreateKeyExW CheckTokenMembership CreateWellKnownSid GetTokenInformation RegCloseKey AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegDeleteKeyW RegDeleteValueW RegSetValueExW RegCreateKeyW RegOpenKeyExW RegQueryValueExW RegOpenKeyW

shell32

SHGetDesktopFolder ShellExecuteExW ord680 DragQueryFileW DragFinish SHAppBarMessage SHGetMalloc ShellExecuteW SHGetFileInfoW SHGetFolderPathW SHBrowseForFolderW SHGetSpecialFolderLocation SHGetPathFromIDListW

shlwapi

PathRemoveFileSpecW PathFindExtensionW PathFindFileNameW PathIsUNCW PathStripToRootW PathFileExistsW StrFormatKBSizeW

uxtheme

GetWindowTheme GetThemeSysColor GetCurrentThemeName DrawThemeText DrawThemeParentBackground DrawThemeBackground IsThemeBackgroundPartiallyTransparent OpenThemeData IsAppThemed GetThemePartSize CloseThemeData GetThemeColor

ole32

ReleaseStgMedium OleDuplicateData CoTaskMemFree CoTaskMemAlloc CoUninitialize CoCreateGuid CoCreateInstance CoInitialize CoDisconnectObject CreateStreamOnHGlobal DoDragDrop OleGetClipboard OleLockRunning RevokeDragDrop RegisterDragDrop CoLockObjectExternal IsAccelerator OleTranslateAccelerator OleDestroyMenuDescriptor OleCreateMenuDescriptor CoInitializeEx

oleaut32

SysFreeString VarBstrFromDate VariantCopy VariantTimeToSystemTime SystemTimeToVariantTime SysStringLen LoadTypeLi SysAllocString VariantChangeType VariantClear VariantInit SysAllocStringLen

gdiplus

GdipBitmapLockBits GdipAlloc GdipFree GdiplusStartup GdipCloneImage GdipDisposeImage GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipDrawImageRectI GdipSetInterpolationMode GdipCreateFromHDC GdipCreateBitmapFromHBITMAP GdipDrawImageI GdipDeleteGraphics GdipBitmapUnlockBits GdiplusShutdown GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipGetImagePaletteSize GdipGetImagePalette

msi

ord92 ord32 ord159 ord160 ord118 ord7 ord8

oleacc

CreateStdAccessibleObject AccessibleObjectFromWindow LresultFromObject

imm32

ImmGetOpenStatus ImmReleaseContext ImmGetContext

winmm

PlaySoundW

Sharing

General

Malware Config

Signatures

File Explorer

2024-08-31_b1deb6df5c05c672790038cd947d7c85_bkransomware_floxif_hijackloader

PE Signature issue

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

shlwapi

uxtheme

ole32

oleaut32

gdiplus

msi

oleacc

imm32

winmm

generic