bms[.]exe | Triage™

Resubmissions

03/07/2026, 18:50

260703-xhe7tsa18q6

03/07/2026, 18:42

260703-xcnl1set7y6

Sharing

Copy URL Twitter E-mail

General

Target
bms.exe
Size 498KB
Sample260703-xcnl1set7y
SHA256 6e0962ab2582d699968c80d527db562e32a5af2b524ad409643e08893b99578d
MD5 fef32b3e4e98b1a5a1b683399b4995cf
SHA1 ce62770f3e425279261141740b426a53e8eb6645
SHA512 5ccdef8fd24e417d245884131b7aaa2c9a2d528f967596c6a39e0e9053323b6b6902586f30721472e1f0afd5fe56c2132615323c067365da4a5028f1cdff2a31
SSDEEP 1536:V8r/5rzYOnUiFCjoczDsjYkVLgMAnZ0sEUuc4VQsWjcdQY4beE79CxcOyh7w1:MXUiFQJDuYkVcAsEUMNQXbeEpCxkh+
TLSH
T143B429427ED44430F6B20D3125A45E72092FFDE69E60A947E3D4710A0BF62CD7A367AE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

bms.exe

.exe 498KB

bms.exe

IMPHASH 51db7658e471767e34dd83d11cbcb3df
SHA256 6e0962ab2582d699968c80d527db562e32a5af2b524ad409643e08893b99578d
MD5 fef32b3e4e98b1a5a1b683399b4995cf
SHA1 ce62770f3e425279261141740b426a53e8eb6645
SHA512 5ccdef8fd24e417d245884131b7aaa2c9a2d528f967596c6a39e0e9053323b6b6902586f30721472e1f0afd5fe56c2132615323c067365da4a5028f1cdff2a31
SSDEEP 1536:V8r/5rzYOnUiFCjoczDsjYkVLgMAnZ0sEUuc4VQsWjcdQY4beE79CxcOyh7w1:MXUiFQJDuYkVcAsEUMNQXbeEpCxkh+
TLSH
T143B429427ED44430F6B20D3125A45E72092FFDE69E60A947E3D4710A0BF62CD7A367AE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

d8:6b:99:e9:ae:a6:e5:72:0a:2f:de:41:65:e2:5b:5e:b0:4a:d8:f5:a6:2a:01:c0:7a:53:5b:b0:81:c6:e1:0d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Crowbar Collective\, INC.,O=Crowbar Collective\, INC.,L=Syracuse,ST=New York,C=US

Chains

Jun 29, 2025

CN=Crowbar Collective\, INC.,O=Crowbar Collective\, INC.,L=Syracuse,ST=New York,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Crowbar Collective\, INC.,O=Crowbar Collective\, INC.,L=Syracuse,ST=New York,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Crowbar Collective\, INC.,O=Crowbar Collective\, INC.,L=Syracuse,ST=New York,C=US

Serial Number

0d:d2:a7:04:0b:89:e9:0b:03:bf:bc:1b:42:e9:49:ea

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 25, 2024 - Apr 26, 2027

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

11136

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Jenkins\workspace\bms_win32\src\launcher_main\Release\bms.pdb

shell32

CommandLineToArgvW

user32

MessageBoxW

kernel32

FlushFileBuffers CreateFileW CloseHandle GetSystemTimeAsFileTime GetProcAddress LocalAlloc LocalFree GetCurrentProcess SetThreadExecutionState GetLastError SetLastError FormatMessageW LoadLibraryW GetModuleFileNameW GetModuleHandleW GetCommandLineW GetEnvironmentVariableW SetEnvironmentVariableW SetDllDirectoryW SetPriorityClass GetVersionExW RaiseException GetCommandLineA IsDebuggerPresent IsProcessorFeaturePresent GetStringTypeW GetCurrentThreadId ExitProcess GetModuleHandleExW MultiByteToWideChar WideCharToMultiByte GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW GetModuleFileNameA WriteFile QueryPerformanceCounter GetCurrentProcessId GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree EnterCriticalSection LeaveCriticalSection GetConsoleCP GetConsoleMode SetFilePointerEx IsValidCodePage GetACP GetOEMCP GetCPInfo HeapFree LoadLibraryExW RtlUnwind OutputDebugStringW SetStdHandle WriteConsoleW HeapAlloc HeapReAlloc HeapSize LCMapStringW

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

bms.exe

shell32

user32

kernel32

generic