BGI[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
BGI.exe
Size 1.3MB
Sample260713-ej1aaadx2t
SHA256 7c9483ece6db674fa8519b306b46966c5c5300662b8838b00f045627184f63ec
MD5 2390db2e0db80784ef2b925ed1558892
SHA1 75d5e6d2ca591da47dac07ee578d801c4e62c9c5
SHA512 ef5797aa2fbede90468476a6539830fbdba902682685d56caf69e45989639672739fe397c94e21dac683d4466188c3c1ab9b31f66bea3dbdab3be0e66efe16f9
SSDEEP 24576:AVbhNObP5qQooy6OWk8F1RcRDfKhw9D2fdaxGjbC71blSHZL:guqQov8ZaKhCYasjbC7vSHt
TLSH
T18D556D21B582D13AE8D100B18AFD7A6BE57D9E38077868E363D43DBE5870DC22E36157
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BGI.exe

File Explorer

BGI.exe

.exe 1.3MB

BGI.exe

IMPHASH 29c18d2fec831f1a8fcdbf43a31fc0f5
SHA256 7c9483ece6db674fa8519b306b46966c5c5300662b8838b00f045627184f63ec
MD5 2390db2e0db80784ef2b925ed1558892
SHA1 75d5e6d2ca591da47dac07ee578d801c4e62c9c5
SHA512 ef5797aa2fbede90468476a6539830fbdba902682685d56caf69e45989639672739fe397c94e21dac683d4466188c3c1ab9b31f66bea3dbdab3be0e66efe16f9
SSDEEP 24576:AVbhNObP5qQooy6OWk8F1RcRDfKhw9D2fdaxGjbC71blSHZL:guqQov8ZaKhCYasjbC7vSHt
TLSH
T18D556D21B582D13AE8D100B18AFD7A6BE57D9E38077868E363D43DBE5870DC22E36157
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

843250

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d3d9

Direct3DCreate9

dinput8

DirectInput8Create

winmm

timeEndPeriod timeGetDevCaps timeSetEvent PlaySoundW timeGetTime mciSendCommandA timeKillEvent timeBeginPeriod

imm32

ImmGetDefaultIMEWnd ImmAssociateContext

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

kernel32

CreateWaitableTimerA SwitchToThread SizeofResource FindResourceA LockResource LoadResource GetTickCount LoadLibraryA GetProcAddress FreeLibrary GetVolumeInformationW FindFirstFileW VirtualFree FindNextFileW DeviceIoControl VirtualAlloc GetDriveTypeA GetModuleFileNameW SetErrorMode FindClose GetVolumeInformationA GetFileAttributesW GetLogicalDriveStringsW GetDiskFreeSpaceA GetDevicePowerState FileTimeToSystemTime GetDiskFreeSpaceExW DeleteFileW GetLocalTime SetCurrentDirectoryW SystemTimeToFileTime GetTempFileNameW GetDriveTypeW GetModuleHandleA SetThreadAffinityMask GetUserDefaultUILanguage GetLogicalProcessorInformation GetCurrentThread CreateDirectoryW RemoveDirectoryW ExitThread SetFileAttributesW OpenMutexA CreateThread CreateProcessW MoveFileW GetExitCodeProcess GetExitCodeThread CopyFileW GlobalMemoryStatus GlobalMemoryStatusEx GetComputerNameA CreateFileMappingA CreateMutexA CreateFileMappingW GetCurrentProcess OpenProcess MultiByteToWideChar FindResourceW QueryPerformanceFrequency QueryPerformanceCounter SetFilePointerEx WaitForMultipleObjects GetCurrentProcessId RtlUnwind GetACP GetThreadPriority MulDiv CreateSemaphoreA ReleaseSemaphore OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime SetWaitableTimer GetModuleHandleW GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter FreeLibraryAndExitThread GetModuleHandleExW UnmapViewOfFile TryEnterCriticalSection ResetEvent GetSystemInfo WaitForSingleObjectEx DecodePointer RaiseException InitializeCriticalSectionEx InitializeCriticalSectionAndSpinCount GlobalUnlock GlobalLock GlobalAlloc GetFileTime ExitProcess GetStdHandle HeapFree HeapAlloc GetFileType LCMapStringW HeapReAlloc HeapSize FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA WideCharToMultiByte GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle GetStringTypeW GetConsoleMode FlushFileBuffers GetFileSize GetLastError CreateFileW SetFilePointer SetFileTime WriteFile ReadFile CreateEventA CloseHandle SetEvent WaitForSingleObject SetThreadPriority DeleteCriticalSection Sleep InitializeCriticalSection LeaveCriticalSection EnterCriticalSection WriteConsoleW GetSystemTime SetLastError GetVersionExA GetCurrentThreadId MapViewOfFile EncodePointer GetConsoleCP TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ReleaseMutex ResumeThread

user32

SystemParametersInfoW PostQuitMessage GetWindowThreadProcessId GetShellWindow GetUserObjectSecurity GetCursorInfo ClientToScreen EnableMenuItem ShowCursor SetCursorPos BringWindowToTop FindWindowW SetForegroundWindow GetKeyboardState IsIconic SetCursor TranslateMessage GetForegroundWindow RegisterHotKey PeekMessageW DispatchMessageW SetActiveWindow UnregisterHotKey GetSystemMenu SetTimer SwapMouseButton KillTimer CloseWindow GetDlgItemTextW IsDlgButtonChecked EnableWindow PostMessageA WaitForInputIdle EnumDisplayMonitors GetCursorPos AdjustWindowRectEx LoadImageA LoadCursorA RegisterClassExW GetSystemMetrics DestroyWindow SetWindowPos GetMonitorInfoA GetClientRect UpdateWindow InvalidateRect MonitorFromWindow FillRect SetRect CallWindowProcW MessageBoxW ScreenToClient EndDialog DialogBoxParamA GetDlgItemTextA SetWindowLongA GetDlgCtrlID CallWindowProcA SetDlgItemTextW SetWindowTextA SendDlgItemMessageW DefWindowProcA SetFocus SendDlgItemMessageA SetDlgItemTextA SendMessageA CreateDialogParamA SetWindowLongW GetDlgItem GetWindowTextLengthA DialogBoxParamW GetWindowTextW IsWindow MessageBoxA OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData IsClipboardFormatAvailable DefWindowProcW PostMessageW GetWindowRect CreateWindowExW SendMessageW SetWindowTextW ShowWindow GetAsyncKeyState RedrawWindow MoveWindow BeginPaint EndPaint GetDC ReleaseDC PeekMessageA PostThreadMessageA GetQueueStatus RegisterWindowMessageA DispatchMessageA MsgWaitForMultipleObjects LoadIconA

gdi32

AddFontMemResourceEx AddFontResourceExW RemoveFontMemResourceEx RemoveFontResourceExW SetBrushOrgEx StretchDIBits GetObjectA GetOutlineTextMetricsW GetTextMetricsA GetCharABCWidthsFloatW DeleteObject SetStretchBltMode GetTextExtentPoint32W TextOutW DeleteDC CreateFontW EnumFontFamiliesExW CreateCompatibleDC CreateDIBSection SelectObject CreatePalette SelectPalette SetBkMode SetTextColor CreateFontA SelectClipRgn CreateRectRgnIndirect GetStockObject GetGlyphOutlineW

comdlg32

GetOpenFileNameA GetSaveFileNameA

advapi32

RegDeleteKeyW RevertToSelf RegCloseKey RegOpenKeyExW RegQueryValueExW AdjustTokenPrivileges LookupPrivilegeValueA GetSecurityDescriptorOwner ImpersonateLoggedOnUser IsValidSid OpenProcessToken DuplicateTokenEx LookupAccountSidW GetUserNameA RegCreateKeyExW RegSetValueExW

shell32

SHBrowseForFolderW ShellExecuteW SHChangeNotify SHGetPathFromIDListW SHGetSpecialFolderLocation SHGetFolderPathW SHGetMalloc DragQueryFileA DragFinish DragAcceptFiles DragQueryFileW

ole32

CoUninitialize CoTaskMemAlloc PropVariantClear CoFreeUnusedLibraries CoInitialize CoTaskMemFree CoCreateInstance

wininet

InternetOpenA InternetCloseHandle InternetReadFile InternetAttemptConnect InternetSetFilePointer InternetQueryDataAvailable InternetOpenUrlA

gdiplus

GdipGetImageEncodersSize GdipBitmapLockBits GdipFree GdipCreateBitmapFromFile GdiplusStartup GdiplusShutdown GdipGetImageHeight GdipGetImageEncoders GdipCloneImage GdipGetImageWidth GdipCreateBitmapFromGdiDib GdipGetImagePixelFormat GdipDisposeImage GdipAlloc GdipBitmapUnlockBits GdipSaveImageToFile

mf

MFCreateTopology MFCreateMediaSession MFCreateTopologyNode MFCreateAudioRendererActivate MFCreateVideoRendererActivate

mfplat

MFCreateFile MFCreateSourceResolver MFStartup MFShutdown MFCreateMFByteStreamOnStream

dsound

ord11

generic

count=35, id=259, version=26213,

count=158, id=261, version=26213,

count=1, id=263, version=26213,

count=10, id=261, productName=VS2017 v15.9.7 build 27027, version=27027,

count=48, id=261, version=26706,

count=17, id=260, version=26706,

count=27, id=259, version=26706,

count=1, id=262, version=26213,

count=1, id=171, productName=VS2010 build 30319, version=30319,

count=30, id=257, version=26213,

count=39, id=261, productName=VS2017 v15.9.5 build 27026, version=27026,

count=29, id=260, version=26213,

count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=3, id=123, productName=VS2005 build 50727, version=50727,

count=392, id=1, productName=Unmarked objects,

count=228, id=265, version=27032,

count=1, id=256, version=27032,

count=1, id=255, version=27032,

count=1, id=151,

count=1, id=258, version=27032,