49220571574da61781de37f35c66e8f0dadb18fdedb6d3a1be67485069cfd4b0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
49220571574da61781de37f35c66e8f0dadb18fdedb6d3a1be67485069cfd4b0.exe
Size 3.5MB
Sample260621-c2nyvsb19x
SHA256 49220571574da61781de37f35c66e8f0dadb18fdedb6d3a1be67485069cfd4b0
MD5 4b7b85d70329e085ab06dcdf9557b0a0
SHA1 3a277203cb4916eb1f55f867f0bd368476c613fb
SHA512 50087b509b58a50db0a67f2aea2838c2783fb2d1d6f5a22d3a68b31e0cdfa7b3b5d469df16af437a6396d3f8dc75fafd689f9af9ce72bfb0c541a3f37ef77f03
SSDEEP 49152:Js0ewfW1oFguIXFkCEDeQi5LpAO85kDe8MS6pBAuowCSHeuOz8eoY3qtI:vfWzuEKCh91Bw8HFwCS+uXevq
TLSH
T163068E9AB7A80198D876D23CC6575217D7F2F8111370A7CF1AA85ABA1F33BD6123E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49220571574da61781de37f35c66e8f0dadb18fdedb6d3a1be67485069cfd4b0.exe

File Explorer

49220571574da61781de37f35c66e8f0dadb18fdedb6d3a1be67485069cfd4b0.exe

.dll 3.5MB

49220571574da61781de37f35c66e8f0dadb18fdedb6d3a1be67485069cfd4b0.exe

IMPHASH 13904d1cc18631217d0dcb5bf82fbc09
SHA256 49220571574da61781de37f35c66e8f0dadb18fdedb6d3a1be67485069cfd4b0
MD5 4b7b85d70329e085ab06dcdf9557b0a0
SHA1 3a277203cb4916eb1f55f867f0bd368476c613fb
SHA512 50087b509b58a50db0a67f2aea2838c2783fb2d1d6f5a22d3a68b31e0cdfa7b3b5d469df16af437a6396d3f8dc75fafd689f9af9ce72bfb0c541a3f37ef77f03
SSDEEP 49152:Js0ewfW1oFguIXFkCEDeQi5LpAO85kDe8MS6pBAuowCSHeuOz8eoY3qtI:vfWzuEKCh91Bw8HFwCS+uXevq
TLSH
T163068E9AB7A80198D876D23CC6575217D7F2F8111370A7CF1AA85ABA1F33BD6123E740
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2262156

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\testing3\data\bdnc\BDNIMBUS-3071711\BDNIMBUS\bin\release\bdnc.pdb

user32

GetUserObjectInformationW MessageBoxW GetProcessWindowStation

crypt32

CertGetCertificateChain CertFreeCertificateChain CertEnumCertificatesInStore CertCreateCertificateContext CertFreeCertificateContext CertEnumCRLsInStore CertGetNameStringA CertCloseStore CertOpenSystemStoreA

winmm

timeGetTime

ws2_32

inet_ntoa inet_addr WSAGetOverlappedResult select getnameinfo WSASend WSARecv getpeername inet_ntop gethostname sendto recvfrom send recv freeaddrinfo getaddrinfo WSASetLastError getprotobynumber getservbyname getservbyport ntohl gethostbyaddr htonl getsockopt getsockname ioctlsocket connect bind accept WSAWaitForMultipleEvents WSASetEvent WSAIoctl WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent socket closesocket shutdown WSAGetLastError WSACleanup WSAStartup ntohs htons listen gethostbyname setsockopt

iphlpapi

if_nametoindex

advapi32

ReportEventW RegisterEventSourceW DeregisterEventSource CryptGenRandom CryptAcquireContextA RegQueryValueExA RegOpenKeyExA RegQueryValueExW RegOpenKeyExW RegCloseKey

secur32

InitSecurityInterfaceA

bcrypt

BCryptGenRandom

kernel32

IsValidCodePage FindFirstFileExW FlushFileBuffers GetFullPathNameW GetCurrentDirectoryW SetEndOfFile GetConsoleOutputCP GetTimeZoneInformation LCMapStringW CompareStringW GetCommandLineW FlsFree GetEnvironmentStringsW FlsGetValue GetOEMCP HeapReAlloc HeapAlloc HeapFree FreeLibraryAndExitThread ResumeThread ExitThread SetConsoleCtrlHandler SetStdHandle ExitProcess FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileInformationByHandle GetDriveTypeW RtlPcToFileHeader RaiseException EncodePointer LoadLibraryExW InterlockedFlushSList GetCPInfo FlsAlloc FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap GetStringTypeW GetCommandLineA FlsSetValue HeapSize WriteConsoleW GetSystemDirectoryA RtlUnwindEx GetStartupInfoW IsDebuggerPresent CloseHandle InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent WaitForSingleObject CreateEventA CreateThread GetCurrentThreadId GetThreadId Sleep TlsAlloc TlsGetValue TlsSetValue TlsFree CreateFileW GetFileSize ReadFile GetLastError ReleaseMutex CreateMutexA GetModuleFileNameW MapViewOfFile UnmapViewOfFile CreateFileMappingA DeleteFileW GetFileSizeEx GetFileTime WriteFile GetCurrentProcessId MoveFileW LocalFree FormatMessageA GetTickCount64 VirtualAlloc VirtualFree SetFilePointerEx SwitchToThread RtlUnwind FreeLibrary GetProcAddress LoadLibraryA LocalAlloc GetVersion InitializeCriticalSectionAndSpinCount TryEnterCriticalSection ResetEvent GetTickCount GetSystemInfo QueryPerformanceCounter QueryPerformanceFrequency SetWaitableTimer GetSystemTimeAsFileTime CreateWaitableTimerA CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus ReleaseSemaphore CreateSemaphoreA SetLastError GetSystemTime SystemTimeToFileTime GetModuleHandleExW InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared SwitchToFiber DeleteFiber CreateFiberEx FindClose FindFirstFileW FindNextFileW MultiByteToWideChar WideCharToMultiByte GetStdHandle GetFileType GetModuleHandleW GetEnvironmentVariableW GetACP ConvertFiberToThread ConvertThreadToFiberEx GetCurrentProcess TerminateProcess LoadLibraryW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead

Name

.text

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

845KB

Virtual Size

844KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

33KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

141KB

Virtual Size

140KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

180KB

Virtual Size

179KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

49220571574da61781de37f35c66e8f0dadb18fdedb6d3a1be67485069cfd4b0.exe

user32

crypt32

winmm

ws2_32

iphlpapi

advapi32

secur32

bcrypt

kernel32

generic