Bonavol_3[.]9[.]1[.]exe

Resubmissions

10/07/2026, 03:06

260710-dl9fascw2k4

10/07/2026, 03:03

260710-dkf3csdw6t6

Sharing

Copy URL Twitter E-mail

General

Target
Bonavol_3.9.1.exe
Size 709KB
Sample260710-dkf3csdw6t
SHA256 268a65829e86d5c3d324eea79b51e59f0a7d07c69d3ba0f700c9cb3aa772566f
MD5 622d263f3fe7b7cdc79c20650bfa0370
SHA1 dc81940101454948dc4b12f5b4a6a8f00c17dd98
SHA512 86103190b30f621a61980b55b303b8a37c13586de6eee4fd7c23d8cbc600ea443b65ea49815303831457d10340fe15d043425d9eb71535e8b9bb511f1e0f5246
SSDEEP 12288:R72vnF1GOH0+8fjf+Dmf9ElWglnENyjokryT08wGErbgYip:RMpSf7+Dmf9GWglnZyT08wqp
TLSH
T1DBF48D9ABBA445F5D5B7C13AC991894AF7B278110B319BDF03A4836F1F236D44E3A321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
Bonavol_3.9.1.exe

File Explorer

Bonavol_3.9.1.exe

.exe 709KB

Bonavol_3.9.1.exe

IMPHASH 69e374040c4b9d552fcf7cc67435e5c4
SHA256 268a65829e86d5c3d324eea79b51e59f0a7d07c69d3ba0f700c9cb3aa772566f
MD5 622d263f3fe7b7cdc79c20650bfa0370
SHA1 dc81940101454948dc4b12f5b4a6a8f00c17dd98
SHA512 86103190b30f621a61980b55b303b8a37c13586de6eee4fd7c23d8cbc600ea443b65ea49815303831457d10340fe15d043425d9eb71535e8b9bb511f1e0f5246
SSDEEP 12288:R72vnF1GOH0+8fjf+Dmf9ElWglnENyjokryT08wGErbgYip:RMpSf7+Dmf9GWglnZyT08wqp
TLSH
T1DBF48D9ABBA445F5D5B7C13AC991894AF7B278110B319BDF03A4836F1F236D44E3A321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

6f:68:c1:3b:2d:d9:e2:59:3c:89:e2:7c:ec:1f:95:05:f0:bc:78:0d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR

Chains

Jan 27, 2019

CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR

Serial Number

05:5f:93:7a:9d:f7:3d:fd:90:ba:98:89:e4:c5:0a:11

Issuer

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 25, 2016 - Jan 29, 2019

Subject

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2021

Minor OS version

Major OS version

Entry point

212976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

libcurl

curl_easy_setopt curl_easy_cleanup curl_easy_init curl_easy_perform

comctl32

InitCommonControlsEx

shlwapi

PathFileExistsA PathFindExtensionA PathIsDirectoryA PathRemoveFileSpecA PathFindFileNameA

kernel32

UnregisterWaitEx QueryDepthSList LoadLibraryW CompareStringW InterlockedPopEntrySList VirtualProtect VirtualFree VirtualAlloc GetVersionExW MoveFileA OutputDebugStringA lstrlenA Sleep DeleteFileA lstrcpyA CreateThread CreateDirectoryA EnterCriticalSection LeaveCriticalSection DeleteCriticalSection ReleaseSemaphore InitializeCriticalSection WaitForSingleObject CreateEventW GetLastError SetEvent CloseHandle ResetEvent CreateSemaphoreW GetModuleHandleA GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SwitchToThread SignalObjectAndWait CreateTimerQueue SetEndOfFile HeapSize RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent WaitForSingleObjectEx GetModuleHandleW GetProcAddress IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead WideCharToMultiByte TryEnterCriticalSection DuplicateHandle GetCurrentThread GetExitCodeThread EncodePointer DecodePointer MultiByteToWideChar SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetTickCount LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo RtlPcToFileHeader RaiseException FreeLibrary LoadLibraryExW RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList ReadFile ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameA GetModuleFileNameW GetStdHandle WriteFile GetACP HeapAlloc HeapFree HeapReAlloc SetFilePointerEx GetConsoleMode ReadConsoleW GetFileType FlushFileBuffers GetConsoleCP IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetProcessHeap SetStdHandle CreateFileW WriteConsoleW

user32

FindWindowExA SetWindowTextA MessageBoxA GetDlgItemTextA SetDlgItemTextA SendMessageA GetDlgItemInt SystemParametersInfoA SetDlgItemInt DialogBoxParamA EndDialog SetWindowPos GetWindowRect CreateWindowExA

shell32

SHFileOperationA ShellExecuteA

Name

.text

Size

472KB

Virtual Size

471KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

175KB

Virtual Size

174KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Bonavol_3.9.1.exe

libcurl

comctl32

shlwapi

kernel32

user32

shell32

generic