bbe80fba40f9652f10a0a2859c89869cc1d992bef30f4798bb65c19673c1eb1e
- SHA256 bbe80fba40f9652f10a0a2859c89869cc1d992bef30f4798bb65c19673c1eb1e
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
BCD启动项创建工具.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
BCD启动项创建工具.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target bbe80fba40f9652f10a0a2859c89869cc1d992bef30f4798bb65c19673c1eb1e
- Size 94KB
- Sample260710-ryt32abs9m
- SHA256 bbe80fba40f9652f10a0a2859c89869cc1d992bef30f4798bb65c19673c1eb1e
- MD5 2f4591eca6409272f5e234352ccd06ad
- SHA1 4b8d42b3e7a053432318e9533e959be3cec3c18d
- SHA512 ed51194382555f3ba659949ffedb585866dc590f769fc37fca7e4f0fcecd9228c25e51f805fad8fc3d7092f57dbb9d9b7c163c0ee2347b4d48020d5e31af3dde
- SSDEEP 1536:YHxJNl2bLAiF1HqdDV+QK8CPaakk18TGOCpduN/kBKINgDJFq2CsXBPP1H+v:6N4bLAsSzK82vkk18F4dHBKA4JFq2CsE
- TLSH T10793029EFDBD1F30D876672114A325A75EEFA54A30E0893C41BD4ACB12C894DEE8C702
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/BCD启动项创建工具.exe
File Explorer
-
bbe80fba40f9652f10a0a2859c89869cc1d992bef30f4798bb65c19673c1eb1e.zip 94KB
-
BCD启动项创建工具.exe.exe 149KB
BCD启动项创建工具.exe
- IMPHASH fe9d2d7aa3492569c1941b70c4fe2d63
- SHA256 23bca03e5fb649a3a1b6ef82b92fb795c20b3810ee7ec5fda75c9ed5545fd9bd
- MD5 237d6969493532e31969f3ef8a88f6d4
- SHA1 a6b4ada05b9fa6191f7eea416ef2855d02fc7940
- SHA512 2da8e8b782ee9eb743b51879e2c048137eecc952089237faab0556da47e462f0f7f1ac0bd01eba2b7484f0058bc2a795a5b57d35368cace08c00997b32feb5da
- SSDEEP 3072:NB35UiWNqCmUWDPuOS5FzR29h1E3kOqu6tirbXmzDQ92:NAozpDPuOjh1ECuAi/XN92
- TLSH T10CE3AF57F6CB40B0D993247206A22376A738F6389B978DFB53D49C4E8F659C0CA39253
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
65025
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CloseHandle
CopyFileW
CreateDirectoryW
CreateFileW
CreateMutexW
CreatePipe
CreateProcessW
DeleteCriticalSection
DeleteFileW
DuplicateHandle
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileW
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceExW
GetDriveTypeW
GetFileAttributesW
GetLastError
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GetStartupInfoW
GetStdHandle
GetSystemTimeAsFileTime
GetVersionExW
GetWindowsDirectoryW
GlobalAlloc
GlobalFree
GlobalLock
GlobalSize
GlobalUnlock
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryExW
LoadLibraryW
MulDiv
MultiByteToWideChar
PeekNamedPipe
QueryPerformanceCounter
ReadFile
RtlUnwind
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VerSetConditionMask
VerifyVersionInfoW
WaitForSingleObject
WideCharToMultiByte
WriteFile
user32
AdjustWindowRectEx
CallWindowProcW
CharLowerW
CreateAcceleratorTableW
CreateWindowExW
DefFrameProcW
DefWindowProcW
DestroyAcceleratorTable
DestroyIcon
DestroyMenu
DestroyWindow
DispatchMessageW
DrawFocusRect
DrawStateW
DrawTextW
EnableWindow
EnumChildWindows
EnumPropsExW
EnumWindows
FillRect
FindWindowExW
FrameRect
GetActiveWindow
GetAsyncKeyState
GetClassNameW
GetClientRect
GetCursorPos
GetDC
GetFocus
GetForegroundWindow
GetIconInfo
GetKeyState
GetMenuItemCount
GetMenuItemInfoW
GetMessageW
GetParent
GetPropW
GetSysColor
GetSysColorBrush
GetSystemMetrics
GetWindow
GetWindowLongW
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
GetWindowThreadProcessId
IntersectRect
InvalidateRect
IsChild
IsIconic
IsWindowEnabled
IsWindowVisible
IsZoomed
KillTimer
LoadCursorW
LoadIconW
MessageBoxW
MoveWindow
MsgWaitForMultipleObjects
PeekMessageW
PostMessageW
RedrawWindow
RegisterClassW
RegisterWindowMessageW
ReleaseDC
RemovePropW
ScreenToClient
SendMessageW
SetActiveWindow
SetFocus
SetForegroundWindow
SetMenu
SetPropW
SetRect
SetWindowLongW
SetWindowPos
SetWindowTextW
ShowWindow
SystemParametersInfoW
TrackPopupMenu
TranslateAcceleratorW
TranslateMessage
UnregisterClassW
UpdateWindow
ValidateRect
keybd_event
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
ole32
CLSIDFromString
CoInitialize
CoUninitialize
OleInitialize
OleUninitialize
RegisterDragDrop
ReleaseStgMedium
RevokeDragDrop
shell32
DragQueryFileW
ExtractIconExW
ShellExecuteExW
Shell_NotifyIconW
shlwapi
PathAddBackslashW
PathFileExistsW
ntdll
NtQuerySystemInformation
gdi32
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCW
CreateDIBSection
CreateFontIndirectW
CreateRectRgn
CreateSolidBrush
DeleteDC
DeleteObject
GetDIBits
GetDeviceCaps
GetObjectType
GetObjectW
GetStockObject
GetTextExtentPoint32W
IntersectClipRect
SelectClipRgn
SelectObject
SetBkColor
SetTextColor
comctl32
CreateStatusWindowW
InitCommonControlsEx
api-ms-win-crt-string-l1-1-0
_wcsdup
_wcsicmp
_wcsnicmp
tolower
wcscat
wcscmp
wcscpy
wcslen
wcsncmp
wcsncpy
comdlg32
GetOpenFileNameW
GetSaveFileNameW
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
setlocale
winmm
timeBeginPeriod
api-ms-win-crt-stdio-l1-1-0
__p__commode
__stdio_common_vswprintf
_set_fmode
fread
fseek
ftell
gdiplus
GdipDeleteFont
GdipDeleteGraphics
GdipDeleteMatrix
GdipDeletePath
GdipDeletePen
GdipDeleteStringFormat
GdipFree
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
free
uxtheme
IsAppThemed
api-ms-win-crt-math-l1-1-0
__setusermatherr
floor
pow
api-ms-win-crt-runtime-l1-1-0
_c_exit
_cexit
_configure_narrow_argv
_controlfp_s
_crt_atexit
_exit
_get_narrow_winmain_command_line
_initialize_narrow_environment
_initialize_onexit_table
_initterm
_initterm_e
_register_onexit_function
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_set_app_type
abort
exit
terminate
Name
.text
Size
64KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.code
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
55KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ