BurntSushi (1)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
BurntSushi (1).exe
Size 8.3MB
Sample260730-yq2apsfn71
SHA256 d3d711eb28af9fd3283d68cd62e04c391946454436d84fc1819d875607c24e3c
MD5 430febe0248b6c0a1eabc2dfa111b0a0
SHA1 577ea601ba5b0f431f147437cef43daf00cc1485
SHA512 48bc7f87b8576c6672e4c3fb8ca8ef3e185cbc322de4fc6bada01a48fedf1e476312a15b84a3fe60b982435c9029e4700fd1cab266dc0a5028cc62fc56212bf9
SSDEEP 98304:wTS0NzqGkkdfWWAQrXAbdkXiWec3FF+3jHy+R:E5WEccipc7D+R
TLSH
T15D9618253A9A9DADC05AC87083478BA3592170CB0B3AB9FF40D495753FA9BF52B3D314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BurntSushi (1).exe

File Explorer

BurntSushi (1).exe

.exe 8.3MB

BurntSushi (1).exe

IMPHASH 9c36f27a0e62a3d38c487d7bf26bdb1f
SHA256 d3d711eb28af9fd3283d68cd62e04c391946454436d84fc1819d875607c24e3c
MD5 430febe0248b6c0a1eabc2dfa111b0a0
SHA1 577ea601ba5b0f431f147437cef43daf00cc1485
SHA512 48bc7f87b8576c6672e4c3fb8ca8ef3e185cbc322de4fc6bada01a48fedf1e476312a15b84a3fe60b982435c9029e4700fd1cab266dc0a5028cc62fc56212bf9
SSDEEP 98304:wTS0NzqGkkdfWWAQrXAbdkXiWec3FF+3jHy+R:E5WEccipc7D+R
TLSH
T15D9618253A9A9DADC05AC87083478BA3592170CB0B3AB9FF40D495753FA9BF52B3D314
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4356576

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

BurntSushi.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

bcryptprimitives

ProcessPrng

kernel32

GetModuleHandleW GetModuleFileNameW AllocConsole DuplicateHandle Thread32Next lstrlenW Thread32First CreateToolhelp32Snapshot AddVectoredExceptionHandler SetConsoleCtrlHandler CreateSemaphoreA SetFilePointerEx GetTimeZoneInformationForYear GetSystemTimePreciseAsFileTime PostQueuedCompletionStatus SetLastError GetStdHandle GetConsoleMode GetFileInformationByHandleEx GetConsoleScreenBufferInfo SetConsoleCursorPosition FillConsoleOutputCharacterA FillConsoleOutputAttribute SetConsoleMode ReleaseSemaphore IsWow64Process GetProcAddress GetSystemWow64DirectoryW GetSystemInfo VirtualAllocEx GetSystemWow64DirectoryA ReadProcessMemory WriteProcessMemory QueryFullProcessImageNameW OpenProcess ReleaseMutex CreateMutexW GetQueuedCompletionStatusEx TerminateProcess FreeConsole FlushInstructionCache CreateIoCompletionPort SetFileCompletionNotificationModes SwitchToThread GetExitCodeThread WaitForSingleObject CreateRemoteThread GetProcessId GetCurrentProcess VirtualQueryEx MoveFileExW CopyFileExW GetSystemTimeAsFileTime CreateProcessW GetCurrentThreadId SetHandleInformation CreatePipe QueryPerformanceCounter InitializeSListHead FreeLibrary DeviceIoControl GetTempPathW GetTempFileNameW CreateActCtxW ActivateActCtx SetUnhandledExceptionFilter GetVolumeInformationW GetDriveTypeW GetExitCodeProcess VirtualFreeEx HeapReAlloc AttachConsole GetConsoleWindow GetDiskFreeSpaceExW LocalFree GetCurrentThread GetCommandLineW GetLogicalDrives DeleteFileW CreateProcessA ExitProcess MultiByteToWideChar WriteConsoleW GetModuleHandleA QueryPerformanceFrequency FormatMessageW GetCurrentDirectoryW WaitForSingleObjectEx LoadLibraryA GetCurrentProcessId CreateMutexA WideCharToMultiByte RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetEnvironmentVariableW CreateFileW SetFileInformationByHandle GetFileInformationByHandle GetFullPathNameW GetFinalPathNameByHandleW CreateDirectoryW FindFirstFileW FindClose CloseHandle HeapFree GetLastError SetThreadStackGuarantee GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW InitializeProcThreadAttributeList UpdateProcThreadAttribute DeleteProcThreadAttributeList CreateNamedPipeW CreateThread ReadFileEx SleepEx WriteFileEx HeapAlloc GetProcessHeap GlobalMemoryStatusEx GetProcessTimes GetSystemTimes GetProcessIoCounters GetTickCount64

advapi32

GetSidIdentifierAuthority ImpersonateSelf SystemFunction036 IsValidSid RevertToSelf MapGenericMask AccessCheck GetNamedSecurityInfoW GetLengthSid RegQueryValueExW RegOpenKeyExW CopySid LookupAccountSidW GetTokenInformation RegCloseKey OpenProcessToken OpenThreadToken

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeSecurity CoUninitialize CoInitializeEx CoInitialize CoTaskMemFree

shell32

DragFinish CommandLineToArgvW SHGetKnownFolderPath Shell_NotifyIconW ShellExecuteW

user32

CreateMenu GetCursorPos PostThreadMessageW GetMenu SetMenuItemInfoW SetForegroundWindow SetMenu DrawMenuBar DestroyMenu DestroyIcon PostMessageW CreatePopupMenu GetMenuItemCount AppendMenuW SetParent GetParent DefWindowProcW ShowWindow SendMessageW GetSubMenu GetMenuItemID DeleteMenu LoadCursorW RegisterClassExW TrackPopupMenu GetWindowTextLengthW GetWindowTextW GetClassNameW EnumThreadWindows EnumChildWindows GetWindowThreadProcessId LoadImageW CreateWindowExW GetMessageW CheckMenuItem SetMenuInfo UnhookWinEvent DestroyWindow MsgWaitForMultipleObjects PeekMessageW CreateWindowExA SetWinEventHook DispatchMessageW TranslateMessage IsDialogMessageW GetAncestor

ws2_32

ioctlsocket connect getsockopt WSAGetLastError setsockopt WSASocketW WSAIoctl bind getsockname WSACleanup WSAStartup getaddrinfo closesocket socket freeaddrinfo send recv getpeername shutdown WSASend

comctl32

InitCommonControlsEx RemoveWindowSubclass DefSubclassProc SetWindowSubclass GetWindowSubclass

ntdll

NtReadFile NtWriteFile RtlGetVersion NtQuerySystemInformation NtCreateFile RtlNtStatusToDosError NtDeviceIoControlFile NtCancelIoFileEx NtQueryInformationProcess

bcrypt

BCryptGenRandom

pdh

PdhOpenQueryA PdhRemoveCounter PdhCollectQueryData PdhCloseQuery PdhGetFormattedCounterValue PdhAddEnglishCounterW

iphlpapi

GetIfTable2 GetIfEntry2 GetAdaptersAddresses FreeMibTable

netapi32

NetUserGetLocalGroups NetApiBufferFree NetUserEnum NetUserGetInfo

secur32

LsaEnumerateLogonSessions LsaGetLogonSessionData LsaFreeReturnBuffer

powrprof

CallNtPowerInformation

oleaut32

SetErrorInfo SysStringLen SysAllocString SysFreeString GetErrorInfo VariantClear

psapi

GetModuleBaseNameW EnumProcessModulesEx GetModuleFileNameExW GetPerformanceInfo

vcruntime140

__CxxFrameHandler3 __current_exception_context __current_exception __C_specific_handler _CxxThrowException memcpy memmove memset memcmp

api-ms-win-crt-math-l1-1-0

trunc round __setusermatherr pow truncf ceil

api-ms-win-crt-convert-l1-1-0

_wtoi64

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-heap-l1-1-0

_set_new_mode realloc free

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _exit exit terminate _cexit _c_exit _register_thread_local_exe_atexit_callback _crt_atexit _register_onexit_function _initterm_e _initterm _seh_filter_exe _set_app_type _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale