silverbullet-server-windows-x86_64 (2)[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

silverbullet-server-windows-x86_64 (2).zip
Size

33.6MB
MD5

bcf074634cacbdacabbb008f15f4471c
SHA1

20e67399fdc0f26b6ad6c7cfe1074b7aab7a6165
SHA256

65ed2add13bea1e4b23e0950dc349a0f23e83ba19044dda7c3c3c93cd92fe41e
SHA512

ee9f644f5cfc3b6e32b53a06ed1259a12998593a8ff55b7b0530d8134be6b997a04f86ae6e8594de6565d15ee5aea3fb32a5a840a3743e29de034629e311bca1
SSDEEP

786432:M7RFejo9BxYD/OvI0kACTQ9flHi2noyDdLX1m5JXcGkkGWw+Lb:YIjsBxYD/okZTIBi2noyDdUcGUWw+Lb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/silverbullet.exe

Files

silverbullet-server-windows-x86_64 (2).zip
.zip
silverbullet.exe
.exe windows:6 windows x64 arch:x64

b1d69c6ce226e271dacf99bb636b0942

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

denort.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll
WakeByAddressSingle
WaitOnAddress

kernel32

IsValidCodePage
SwitchToThread
CloseHandle
HeapReAlloc
lstrlenW
FreeEnvironmentStringsW
GetCurrentProcess
DuplicateHandle
GetConsoleScreenBufferInfo
GetLastError
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
GlobalUnlock
SetThreadErrorMode
GetProcAddress
LoadLibraryExW
HeapFree
Sleep
FormatMessageW
CreateFileW
GetFileInformationByHandle
GetFileAttributesW
SetCurrentDirectoryW
GetStdHandle
SetConsoleCursorPosition
CreateIoCompletionPort
GetSystemInfo
OpenProcess
GetPriorityClass
SetPriorityClass
TerminateProcess
GetFileType
GetConsoleMode
WriteConsoleInputW
PeekConsoleInputW
FlushConsoleInputBuffer
GetCurrentProcessId
SetConsoleMode
WaitForMultipleObjects
GetNumberOfConsoleInputEvents
ResetEvent
CreateNamedPipeW
ConnectNamedPipe
GlobalMemoryStatusEx
GetTickCount64
CreateSemaphoreW
CreateToolhelp32Snapshot
Process32First
Process32Next
GetDiskFreeSpaceW
FreeLibrary
SetErrorMode
LoadLibraryW
CreatePipe
WaitForSingleObject
CreateEventA
WideCharToMultiByte
SetFileTime
LockFileEx
UnlockFile
GetFileInformationByHandleEx
SetLastError
GetFullPathNameW
DeviceIoControl
FindResourceA
LoadResource
SizeofResource
LockResource
UnmapViewOfFile
VirtualProtect
CreateFileMappingW
MapViewOfFile
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
ReadFile
GetOverlappedResult
WriteFile
CancelIoEx
SetFileCompletionNotificationModes
WaitForSingleObjectEx
CancelIo
ReadDirectoryChangesW
ReleaseSemaphore
GetModuleHandleA
GlobalLock
GlobalSize
ReadConsoleInputW
GetConsoleCursorInfo
SetConsoleCursorInfo
WriteConsoleW
FillConsoleOutputCharacterA
FillConsoleOutputAttribute
VirtualQuery
IsThreadAFiber
ConvertThreadToFiber
CreateFiber
SwitchToFiber
DeleteFiber
ConvertFiberToThread
MultiByteToWideChar
CreateWaitableTimerExW
SetWaitableTimer
QueryPerformanceFrequency
GetModuleHandleW
GetCurrentDirectoryW
LoadLibraryA
CreateMutexA
ReleaseMutex
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
GetEnvironmentVariableW
GetEnvironmentStringsW
SetEnvironmentVariableW
GetTempPathW
GetModuleFileNameW
GetCommandLineW
SetFileInformationByHandle
FlushFileBuffers
GetFinalPathNameByHandleW
SetFilePointerEx
FindNextFileW
CreateDirectoryW
FindFirstFileW
FindClose
ReadConsoleW
SetHandleInformation
CompareStringOrdinal
GetSystemDirectoryW
GetACP
CreateProcessW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
CreateThread
ReadFileEx
SleepEx
WriteFileEx
GetExitCodeProcess
CreateEventW
ExitProcess
QueryPerformanceCounter
GetSystemTimePreciseAsFileTime
HeapAlloc
GetProcessHeap
DeleteFileW
MoveFileExW
RemoveDirectoryW
CreateSymbolicLinkW
CreateHardLinkW
CopyFileExW
SetFileAttributesW
RegisterWaitForSingleObject
UnregisterWaitEx
GetProcessId
SetConsoleCtrlHandler
RemoveVectoredExceptionHandler
SetConsoleTextAttribute
VirtualAlloc
VirtualFree
GetTickCount
FormatMessageA
GetSystemTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
GetFileSize
LocalFree
HeapDestroy
HeapCompact
DeleteFileA
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
HeapCreate
AreFileApisANSI
RaiseException
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
GetNativeSystemInfo
GetLocaleInfoEx
RtlUnwind
GetTempFileNameA
VerSetConditionMask
VerifyVersionInfoW
MapViewOfFileEx
IsDebuggerPresent
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
TryAcquireSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
TryAcquireSRWLockShared
QueryThreadCycleTime
GetThreadPriority
SetThreadPriority
RtlAddFunctionTable
RtlDeleteFunctionTable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
FlsAlloc
FlsGetValue
FlsSetValue
SetUnhandledExceptionFilter
RtlCaptureStackBackTrace
GetDynamicTimeZoneInformation
GetUserGeoID
GetGeoInfoW
CreateSemaphoreA
InitializeConditionVariable
SuspendThread
GetThreadContext
ResumeThread
ResolveLocaleName
GetCurrencyFormatEx
GetNumberFormatEx
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDateFormatEx
GetTimeFormatEx
GetStringTypeW
GetFileSizeEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FlsFree
GetCommandLineA
GetConsoleOutputCP
GetCPInfo
GetOEMCP
SetStdHandle
FindFirstFileExW
GetWindowsDirectoryW
GetTimeZoneInformation
FreeLibraryAndExitThread
ExitThread
GetModuleHandleExW
InitializeCriticalSectionAndSpinCount
EncodePointer
InterlockedPushEntrySList
RtlPcToFileHeader
RtlUnwindEx
GetStartupInfoW
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter

user32

DefWindowProcA
CloseClipboard
RegisterClassExA
GetClientRect
MapVirtualKeyW
OpenClipboard
ReleaseDC
GetClipboardData
CreateWindowExA
GetDC
DestroyWindow

shell32

SHGetKnownFolderPath

gdi32

SetPixelFormat
GetPixelFormat
ChoosePixelFormat
DescribePixelFormat

ntdll

RtlGetVersion
NtReadFile
NtCreateFile
NtDeviceIoControlFile
RtlNtStatusToDosError
NtCancelIoFileEx
NtWriteFile
NtQueryInformationFile
NtQuerySystemInformation

opengl32

wglCreateContext
wglMakeCurrent
wglGetProcAddress
wglDeleteContext
wglGetCurrentContext

crypt32

CertFreeCertificateContext
CertOpenStore
CertVerifyTimeValidity
CertGetEnhancedKeyUsage
CertCloseStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext

ole32

CoTaskMemFree

winmm

timeEndPeriod
timeBeginPeriod
timeGetTime

ws2_32

ioctlsocket
accept
shutdown
getsockopt
recv
send
WSAIoctl
sendto
WSAStartup
GetHostNameW
recvfrom
WSASocketW
WSAGetLastError
setsockopt
listen
closesocket
bind
getaddrinfo
freeaddrinfo
WSACleanup
WSASend
socket
getpeername
getsockname
WSADuplicateSocketW
connect

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SystemFunction036
RegQueryInfoKeyW
RegQueryValueExW
EventWriteTransfer
GetUserNameW
EventSetInformation
RegCloseKey
RegOpenKeyExW
RegEnumKeyExW
EventRegister

psapi

GetProcessMemoryInfo
GetPerformanceInfo

iphlpapi

GetAdaptersAddresses

bcrypt

BCryptGenRandom

d3dcompiler_47

D3DCompile

dbghelp

SymFromAddr
SymSetSearchPathW
SymGetSearchPathW
SymInitialize
SymSetOptions
SymGetLineFromAddr64

Exports

Exports

CrashForExceptionInNonABICompliantCodeRange

Sections

.text
Size: 47.6MB - Virtual size: 47.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28.3MB - Virtual size: 28.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 240KB - Virtual size: 397KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 206KB - Virtual size: 205KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.pedata
Size: 14.6MB - Virtual size: 14.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b1d69c6ce226e271dacf99bb636b0942

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

user32

shell32

gdi32

ntdll

opengl32

crypt32

ole32

winmm

ws2_32

advapi32

psapi

iphlpapi

bcrypt

d3dcompiler_47

dbghelp

Exports

Exports

Sections

.text Size: 47.6MB - Virtual size: 47.6MB

.rdata Size: 28.3MB - Virtual size: 28.3MB

.data Size: 240KB - Virtual size: 397KB

.pdata Size: 1.8MB - Virtual size: 1.8MB

.rsrc Size: 109KB - Virtual size: 108KB

.reloc Size: 206KB - Virtual size: 205KB

.pedata Size: 14.6MB - Virtual size: 14.6MB

.text
Size: 47.6MB - Virtual size: 47.6MB

.rdata
Size: 28.3MB - Virtual size: 28.3MB

.data
Size: 240KB - Virtual size: 397KB

.pdata
Size: 1.8MB - Virtual size: 1.8MB

.rsrc
Size: 109KB - Virtual size: 108KB

.reloc
Size: 206KB - Virtual size: 205KB

.pedata
Size: 14.6MB - Virtual size: 14.6MB