Bitware[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Bitware.exe
Size 8.4MB
Sample260703-rmyl3say21
SHA256 1add7960022dcea6d9a1562823a35829b33e9a3586c0f6b2407b9e4e7bd3e9ed
MD5 8b88a171dc36b281103e148952234e5c
SHA1 b307406428532d01c3bad313d7d89e5168ede85b
SHA512 4b858a6df21747c18b0a397b746c1cc728b9777d7a070d8207e0ab158a3a6da75126d52be7b4d1c90f36778b264eea58402540561e71ea4196e8acdbba4e478c
SSDEEP 98304:9Op09KXTqUKUWc6ndSKCm7Gygu1ODhMzScViMfl:900UXTvKUW/RCjygu1o8Tl
TLSH
T103969C759A9D4F1DF072B079C187A223A7F1BC0D2361DF8BA9C49C77481F098BAA560D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
Bitware.exe

File Explorer

Bitware.exe

.exe 8.4MB

Bitware.exe

IMPHASH 12cfd3c13469d4541dadb55354d70879
SHA256 1add7960022dcea6d9a1562823a35829b33e9a3586c0f6b2407b9e4e7bd3e9ed
MD5 8b88a171dc36b281103e148952234e5c
SHA1 b307406428532d01c3bad313d7d89e5168ede85b
SHA512 4b858a6df21747c18b0a397b746c1cc728b9777d7a070d8207e0ab158a3a6da75126d52be7b4d1c90f36778b264eea58402540561e71ea4196e8acdbba4e478c
SSDEEP 98304:9Op09KXTqUKUWc6ndSKCm7Gygu1ODhMzScViMfl:900UXTvKUW/RCjygu1o8Tl
TLSH
T103969C759A9D4F1DF072B079C187A223A7F1BC0D2361DF8BA9C49C77481F098BAA560D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

10:c0:14:57:b9:bf:e5:1f:37:ab:32:33:5b:09:1a:24:04:55:6f:69:8e:bb:4a:18:bb:54:d9:85:fe:63:d5:5a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bitware

Chains

Jul 2, 2026

CN=Bitware

Subject

CN=Bitware

Serial Number

40:f0:70:b8:37:06:96:81:42:6a:55:84:4e:cd:97:2b

Issuer

CN=Bitware

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 2, 2026 - Jul 2, 2029

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

7013628

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3dcompiler_47

D3DCompile

ole32

CoInitializeEx CoUninitialize CoCreateInstance CoTaskMemFree

winhttp

WinHttpConnect WinHttpSetTimeouts WinHttpCrackUrl WinHttpSendRequest WinHttpReadData WinHttpQueryHeaders WinHttpReceiveResponse WinHttpOpen WinHttpCloseHandle WinHttpOpenRequest

advapi32

RegCloseKey RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryValueExW

msvcp140

?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ?good@ios_base@std@@QEBA_NXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?_Xlength_error@std@@YAXPEBD@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_id _Query_perf_counter _Thrd_join _Mtx_unlock _Thrd_detach ?_Random_device@std@@YAIXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?uncaught_exceptions@std@@YAHXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ

msvcp140_atomic_wait

__std_atomic_notify_all_direct __std_atomic_wait_direct

gdi32

SetTextCharacterExtra GetDeviceCaps DeleteObject MoveToEx GetStockObject CreateFontW CreateCompatibleDC SelectObject CreateCompatibleBitmap Rectangle CreatePen LineTo SetBkMode CreateSolidBrush DeleteDC BitBlt SetTextColor

dwmapi

DwmSetWindowAttribute

user32

DestroyWindow SetWindowPos FillRect CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW DispatchMessageW SetTimer SetLayeredWindowAttributes DrawTextW KillTimer UpdateWindow InvalidateRect BeginPaint EndPaint ShowWindow MessageBoxA GetWindowTextW CallNextHookEx SetWindowsHookExA UnhookWindowsHookEx DispatchMessageA GetAsyncKeyState TranslateMessage PeekMessageA MonitorFromPoint PostMessageA IsWindow SetWindowLongA DefWindowProcA GetWindowRect PostQuitMessage RegisterClassExA SetForegroundWindow IsIconic GetWindowThreadProcessId IsWindowVisible EnumWindows OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetKeyState GetMessageExtraInfo LoadCursorA GetDC ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos ReleaseDC GetCursorPos PostMessageW DefWindowProcW GetMessageW CreateWindowExA

kernel32

GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose GetLocaleInfoEx FormatMessageA LocalFree GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive CreateFileMappingA UnmapViewOfFile MapViewOfFile HeapFree HeapAlloc GetFileSizeEx GetModuleHandleW DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection CreateDirectoryW MoveFileExW AreFileApisANSI GetLastError ReadFile GetExitCodeProcess SetConsoleTitleW AllocConsole SetConsoleOutputCP GetConsoleWindow CopyFileW CreateProcessW Process32FirstW Process32NextW GetFileAttributesW CreateFileW GetTempPathW GetModuleFileNameW ExitProcess AddVectoredExceptionHandler GetConsoleMode VirtualAlloc SetConsoleMode GetModuleHandleExW GetStdHandle VirtualFree VirtualProtect RemoveVectoredExceptionHandler GetModuleFileNameA CreateThread CloseHandle Sleep WaitForSingleObject FlushFileBuffers CreateFileA WriteFile GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA MultiByteToWideChar GetLocaleInfoA GetModuleHandleA GetFileInformationByHandleEx WakeAllConditionVariable GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter SetFileInformationByHandle CreateToolhelp32Snapshot CreateFile2 DeleteFileW

shell32

ShellExecuteW SHGetKnownFolderPath SHFileOperationW ShellExecuteA

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext ImmGetContext

winmm

timeBeginPeriod timeEndPeriod

bcrypt

BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptCreateHash BCryptGetProperty BCryptOpenAlgorithmProvider

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp memchr memset memmove memcpy longjmp strrchr wcsstr __C_specific_handler strchr __current_exception_context __intrinsic_setjmp _CxxThrowException __current_exception strstr __std_terminate __std_exception_copy __std_exception_destroy

api-ms-win-crt-math-l1-1-0

__setusermatherr acosf _fdclass ceilf cosf sqrtf roundf ldexp sinf powf nearbyint fmodf

api-ms-win-crt-stdio-l1-1-0

setvbuf fputc fsetpos _fseeki64 _get_stream_buffer_pointers ungetc _set_fmode __stdio_common_vswprintf freopen_s fgetc fgetpos __stdio_common_vsprintf_s __p__commode __stdio_common_vsscanf __stdio_common_vswprintf_s fread __stdio_common_vsprintf _wfopen fwrite fseek fclose fflush __acrt_iob_func ftell __stdio_common_vfprintf

api-ms-win-crt-utility-l1-1-0

srand qsort rand

api-ms-win-crt-heap-l1-1-0

_callnewh malloc free _set_new_mode realloc

api-ms-win-crt-convert-l1-1-0

strtoull atoi _wtoi64 strtof strtol

api-ms-win-crt-runtime-l1-1-0

terminate _initterm_e _beginthreadex exit _register_thread_local_exe_atexit_callback _c_exit _errno _initterm _cexit _exit _get_initial_narrow_environment _crt_atexit _initialize_onexit_table _initialize_narrow_environment __p___argc _configure_narrow_argv _register_onexit_function _seh_filter_exe __p___argv _set_app_type abort

api-ms-win-crt-string-l1-1-0

strncpy _wcsupr_s wcscat_s wcscpy_s _wcsicmp strcmp wcslen isspace tolower strcpy_s strncpy_s strlen _stricmp strncmp

api-ms-win-crt-time-l1-1-0

_time64 _localtime64_s

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

Name

.text

Size

6.7MB

Virtual Size

6.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

274KB

Virtual Size

299KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vcdata

Size

512B

Virtual Size

123B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Bitware.exe

PE Signature issue

d3dcompiler_47

ole32

winhttp

advapi32

msvcp140

msvcp140_atomic_wait

gdi32

dwmapi

user32

kernel32

shell32

imm32

winmm

bcrypt

vcruntime140_1

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic