BDREvilDecryptor[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
BDREvilDecryptor.exe
Size 9.4MB
Sample260803-wx2hyavgla
SHA256 b95acb0ac8f4ff7ebaa9788423e4daa400d50cfa3cbbeda6f9a11535ecdf771e
MD5 dcfbb2c52436d6ac8b6e43f3243b6d98
SHA1 e6c32d994f307bc436ed6692b8ae13c2c7a02aad
SHA512 c134a79684a307a8c58f26812b527ac1a92ba9d12b88ddcfb8ef2a51d0f1ffbe98db9db78ea1ed11af922ba92f8b8347a191a2287a729dfe54215f6e12e13ef7
SSDEEP 196608:T82GnZ4zm5v9WtwPlARRmtejsum35JGX8W46+ZR62Wi7:NGnZ15v99PlAGMitpF762Wi
TLSH
T1A2A633463BF7DE53E9164D793C6810F9E629F68018E18DBB04B453FE06B13972B8E249
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

BDREvilDecryptor.exe

.exe 9.4MB

BDREvilDecryptor.exe

IMPHASH c74d023a3a70b67ec7742ec93d3b5f0a
SHA256 b95acb0ac8f4ff7ebaa9788423e4daa400d50cfa3cbbeda6f9a11535ecdf771e
MD5 dcfbb2c52436d6ac8b6e43f3243b6d98
SHA1 e6c32d994f307bc436ed6692b8ae13c2c7a02aad
SHA512 c134a79684a307a8c58f26812b527ac1a92ba9d12b88ddcfb8ef2a51d0f1ffbe98db9db78ea1ed11af922ba92f8b8347a191a2287a729dfe54215f6e12e13ef7
SSDEEP 196608:T82GnZ4zm5v9WtwPlARRmtejsum35JGX8W46+ZR62Wi7:NGnZ15v99PlAGMitpF762Wi
TLSH
T1A2A633463BF7DE53E9164D793C6810F9E629F68018E18DBB04B453FE06B13972B8E249
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

93:96:be:6f:32:64:c7:95:69:19:d6:27:96:2f:32:93:97:8c:57:04:f5:66:e4:25:71:60:84:20:d6:b2:c2:33

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Bitdefender SRL,O=Bitdefender SRL,L=Bucharest,C=RO

Chains

Sep 22, 2021

CN=Bitdefender SRL,O=Bitdefender SRL,L=Bucharest,C=RO

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

0e:47:15:f3:c8:84:82:f7:75:e7:b8:b9:05:45:43:c9:3c:0b:0b:60

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bitdefender SRL,O=Bitdefender SRL,L=Bucharest,C=RO

Chains

Sep 22, 2021

CN=Bitdefender SRL,O=Bitdefender SRL,L=Bucharest,C=RO

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=Bitdefender SRL,O=Bitdefender SRL,L=Bucharest,C=RO

Serial Number

0d:32:b8:a4:68:df:3b:34:c0:09:a7:74:9a:68:29:f0

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 27, 2020 - Dec 5, 2023

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=Bitdefender SRL,O=Bitdefender SRL,L=Bucharest,C=RO

Serial Number

0b:02:a4:0e:13:21:fb:40:cc:eb:94:78:22:46:bc:8d

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 14, 2020 - Dec 5, 2023

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

17453

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

MessageBoxW wsprintfW

shell32

SHFileOperationW

kernel32

WriteConsoleW SetFilePointerEx CreateDirectoryW GetCommandLineW WriteFile GetTempPathW CreateFileW CloseHandle GetNativeSystemInfo LoadResource FindResourceW CreateProcessW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcess TerminateProcess RaiseException RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW DecodePointer GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA HeapFree HeapAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW CompareStringW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleCP GetConsoleMode

Sharing

General

Malware Config

Signatures

File Explorer

BDREvilDecryptor.exe

PE Signature issue

user32

shell32

kernel32

generic