bigdick[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
bigdick.exe
Size 282KB
Sample260804-dscd5svsd1
SHA256 c213cb38d2f6526538e0c49c852ea6d438672809c71939c4eb0bc949ff245a6c
MD5 918478a2e1979be5619ee5702e5ac6bf
SHA1 a194d5a96875920a147d45e770714aede00f3ff0
SHA512 50f74ddd1450f73a052ba47c3931b06197be5108dc969642a791e09f9b2ca99e2080f4a70231cd787eec858f03af72cc25d150be32faea1be0baeb2ee4750e19
SSDEEP 6144:HxUoUBF7fXO9INw2lAwihZwZ84N9l+I60m5XUlROrsFb0ZhzpKf5H:RUoUTVHlfQmTOI60m5XUl2sFgZhzpKf
TLSH
T19B544B3EA64509B4E567C178CE479413FF633C4B4371DAEB17D09AA62F279D0BA3A900
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bigdick.exe

File Explorer

bigdick.exe

.exe 282KB

bigdick.exe

IMPHASH e945a22c4ceeb508c21e4c4fd4ba4857
SHA256 c213cb38d2f6526538e0c49c852ea6d438672809c71939c4eb0bc949ff245a6c
MD5 918478a2e1979be5619ee5702e5ac6bf
SHA1 a194d5a96875920a147d45e770714aede00f3ff0
SHA512 50f74ddd1450f73a052ba47c3931b06197be5108dc969642a791e09f9b2ca99e2080f4a70231cd787eec858f03af72cc25d150be32faea1be0baeb2ee4750e19
SSDEEP 6144:HxUoUBF7fXO9INw2lAwihZwZ84N9l+I60m5XUlROrsFb0ZhzpKf5H:RUoUTVHlfQmTOI60m5XUl2sFgZhzpKf
TLSH
T19B544B3EA64509B4E567C178CE479413FF633C4B4371DAEB17D09AA62F279D0BA3A900
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

195760

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\L1X\Downloads\Manual\Manual\Manual\main\main\x64\Release\main.pdb

kernel32

GetLastError Process32NextW Process32FirstW CloseHandle FillConsoleOutputAttribute LocalFree GetSystemTime SetConsoleCursorPosition SetConsoleTitleW ConnectNamedPipe GetExitCodeProcess ReleaseSRWLockExclusive InitializeSListHead GetSystemTimeAsFileTime Sleep GetCurrentProcessId QueryPerformanceCounter GetModuleHandleW IsDebuggerPresent IsProcessorFeaturePresent GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive CreateToolhelp32Snapshot CreateFileW CreateNamedPipeW TerminateProcess WriteFile GetStdHandle SetConsoleTextAttribute GetConsoleScreenBufferInfo SetConsoleCtrlHandler FillConsoleOutputCharacterA GetModuleFileNameA GetCurrentThreadId ReadFile

user32

GetAsyncKeyState

bcrypt

BCryptSetProperty BCryptHashData BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptExportKey BCryptCreateHash BCryptOpenAlgorithmProvider BCryptGenerateKeyPair BCryptFinalizeKeyPair BCryptGetProperty BCryptDestroyKey BCryptEncrypt BCryptGenerateSymmetricKey BCryptGenRandom

crypt32

CertOpenStore CertFindCertificateInStore CryptImportPublicKeyInfoEx2 CertStrToNameA CertCloseStore PFXExportCertStore CryptBinaryToStringA CryptStringToBinaryA CertFreeCertificateContext CertCreateSelfSignCertificate CryptDecodeObjectEx PFXImportCertStore

msvcp140

_Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?id@?$collate@D@std@@2V0locale@2@A _Mtx_lock _Strcoll _Cnd_do_broadcast_at_thread_exit _Thrd_id _Query_perf_counter _Thrd_detach _Xtime_get_ticks _Thrd_join _Strxfrm ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?tolower@?$ctype@D@std@@QEBADD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z _Mtx_unlock

winhttp

WinHttpOpen WinHttpReadData WinHttpReceiveResponse WinHttpCloseHandle WinHttpSendRequest WinHttpSetTimeouts WinHttpQueryDataAvailable WinHttpConnect WinHttpOpenRequest

ws2_32

accept bind closesocket listen getaddrinfo WSAStartup send socket connect recv setsockopt htons htonl WSAGetLastError freeaddrinfo

secur32

EncryptMessage AcceptSecurityContext InitializeSecurityContextW DecryptMessage FreeCredentialsHandle AcquireCredentialsHandleW FreeContextBuffer DeleteSecurityContext QueryContextAttributesW

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove __std_exception_destroy _CxxThrowException __C_specific_handler __current_exception_context __current_exception memset memcpy memcmp strchr __std_terminate __std_exception_copy

api-ms-win-crt-stdio-l1-1-0

_get_stream_buffer_pointers _set_fmode _fseeki64 fread fsetpos ungetc fputc fflush fgetc fclose setvbuf __stdio_common_vsprintf_s __p__commode fwrite fgetpos

api-ms-win-crt-heap-l1-1-0

malloc free _set_new_mode realloc _callnewh

api-ms-win-crt-string-l1-1-0

_wcsicmp toupper tolower

api-ms-win-crt-runtime-l1-1-0

system terminate _beginthreadex _c_exit __p___argv __p___argc _invoke_watson _register_thread_local_exe_atexit_callback _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function exit _crt_atexit _cexit _seh_filter_exe _set_app_type _exit _get_initial_narrow_environment _initterm _initterm_e

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-convert-l1-1-0

atoi _strtoui64 strtoul

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale