Bubbles[.]scr | Triage™

Resubmissions

15/05/2026, 15:45

260515-s7hl2afw9n3

06/05/2026, 03:01

260506-dhxbkahz2x

06/05/2026, 02:44

260506-c794aahy4v9

06/05/2026, 02:41

260506-c6mllahy2x4

Sharing

Copy URL Twitter E-mail

General

Target
Bubbles.scr
Size 864KB
Sample260506-c6mllahy2x
SHA256 e0c3f0794ff8f4e2091ad73445b3a8b14c745124ad6907202fc6c1c8e674d99d
MD5 fb18f89c3b55d82f5b125a5588dd78f0
SHA1 96340ccda48ef84fdeb4b4d963119c72beb0538c
SHA512 c45a764a78932f0f7e2d7054f1ae77627aab055fc16bf85cf8f97e10390f4272986f8da0f9c593efee9b2f2f3b7a43ad96847f251ff23fc5ceb69dee414579bf
SSDEEP 6144:bAblq214ppN9tVEmGETRct4qNporbwOj8q/BBFrHMObAnTjy6Vg:bAblq214pz9PrR
TLSH
T19B15B271373F648AE1A580349355B30699E0F31DB3A38AE7385D4074DED92D2AA3AFD1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Bubbles.scr

File Explorer

Bubbles.scr

.exe 864KB

Bubbles.scr

IMPHASH 78042697d0562b6892fc955170a66aee
SHA256 e0c3f0794ff8f4e2091ad73445b3a8b14c745124ad6907202fc6c1c8e674d99d
MD5 fb18f89c3b55d82f5b125a5588dd78f0
SHA1 96340ccda48ef84fdeb4b4d963119c72beb0538c
SHA512 c45a764a78932f0f7e2d7054f1ae77627aab055fc16bf85cf8f97e10390f4272986f8da0f9c593efee9b2f2f3b7a43ad96847f251ff23fc5ceb69dee414579bf
SSDEEP 6144:bAblq214ppN9tVEmGETRct4qNporbwOj8q/BBFrHMObAnTjy6Vg:bAblq214pz9PrR
TLSH
T19B15B271373F648AE1A580349355B30699E0F31DB3A38AE7385D4074DED92D2AA3AFD1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7504

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Bubbles.pdb

advapi32

EventUnregister EventRegister EventSetInformation EventWriteTransfer EventActivityIdControl RegOpenKeyExW RegQueryValueExW RegCloseKey RegOpenKeyExA RegQueryValueExA

kernel32

LeaveCriticalSection CreateMutexExW GetCurrentProcessId CreateSemaphoreExW Sleep GetTickCount ReleaseSRWLockShared ReleaseSRWLockExclusive InitOnceBeginInitialize OutputDebugStringA IsProcessorFeaturePresent MulDiv CreateThreadpoolTimer OpenSemaphoreW WaitForSingleObject DeleteCriticalSection InitializeCriticalSectionEx InitializeCriticalSection EnterCriticalSection AcquireSRWLockShared AcquireSRWLockExclusive WaitForSingleObjectEx CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer ReleaseMutex ReleaseSemaphore CloseHandle SetLastError OutputDebugStringW IsDebuggerPresent GetLastError DebugBreak GetModuleFileNameA GetModuleHandleExW HeapFree GetProcAddress GetModuleHandleW HeapAlloc GetProcessHeap GetCurrentThreadId FormatMessageW InitOnceComplete

gdi32

ExcludeClipRect SetTextColor SetBkColor CreateFontW GetDeviceCaps GetStockObject DeleteDC DeleteObject BitBlt GetDIBits CreateBitmap CreateCompatibleDC SelectObject

user32

SystemParametersInfoA SetRectEmpty PostMessageW GetMessageW PostQuitMessage TranslateMessage DispatchMessageW EnumDisplaySettingsW LoadCursorW LoadIconW RegisterClassW GetClientRect AdjustWindowRect CreateWindowExW SystemParametersInfoW PeekMessageW SetTimer KillTimer SetCursor BeginPaint FillRect EndPaint DefWindowProcW UnionRect ScreenToClient InvalidateRect UpdateWindow SetRect DrawTextW MessageBoxW GetSystemMetrics GetDC EnumDisplayMonitors OffsetRect IntersectRect LoadStringW SetWindowPos

msvcrt

?terminate@@YAXXZ __CxxFrameHandler3 _onexit __dllonexit _unlock _lock _commode _fmode _acmdln memset __C_specific_handler _initterm __setusermatherr _ismbblead _cexit _exit exit __set_app_type __getmainargs _amsg_exit _XcptFilter _callnewh malloc free _purecall time srand memmove_s memcpy_s _vsnwprintf rand iswdigit _atoi64 qsort _finite acosf atan2f cosf memcmp memcpy sinf sqrtf

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess GetStartupInfoW TerminateProcess

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable SleepConditionVariableSRW

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter SetUnhandledExceptionFilter

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter QueryPerformanceFrequency

api-ms-win-core-sysinfo-l1-1-0

GetVersionExA GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind

api-ms-win-core-string-l1-1-0

WideCharToMultiByte MultiByteToWideChar

api-ms-win-core-com-l1-1-0

CoInitializeEx CoUninitialize

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

api-ms-win-core-libraryloader-l1-2-0

LockResource SizeofResource LoadResource

comctl32

InitCommonControlsEx ord344

d3d9

Direct3DCreate9

winmm

timeGetTime

Name

.text

Size

140KB

Virtual Size

137KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

fothk

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

24KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

676KB

Virtual Size

675KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

600B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Bubbles.scr

advapi32

kernel32

gdi32

user32

msvcrt

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-libraryloader-l1-2-0

comctl32

d3d9

winmm

generic