batfuscator[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
batfuscator.exe
Size 314KB
Sample260808-sp4rjseb36
SHA256 4c4ea8a4bbcb17160f10fc7f8e741da7a67323770b503affa4c0befa9e19a2ab
MD5 237d3301c6aab2842bfea4dc3b22fd09
SHA1 05226a63b777574aa4d53dc43e77ba9e22fee548
SHA512 fedde8ea883737925181eaf611aa75678254d1d6b48c43706c4b120c93604a0df4b80254f39990e1aa6c59e902dbac33ad2e3916dde872ca2e262b4f7e12db99
SSDEEP 6144:WFKz8sLkpankSsHP7th3QBULd3lAdD+213briFF1/0YbP+SnZuHH3fQLR:ZmXQldDF3vM1/l/ZuHH3Y9
TLSH
T1F4647B42A2B480B1D57111F0FABE3B5F883D38956F2486C773D4495CABE01E365FAB86
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
batfuscator.exe

File Explorer

batfuscator.exe

.exe 314KB

batfuscator.exe

IMPHASH cbf9a84d1990de2ea5bc915cfcb672c0
SHA256 4c4ea8a4bbcb17160f10fc7f8e741da7a67323770b503affa4c0befa9e19a2ab
MD5 237d3301c6aab2842bfea4dc3b22fd09
SHA1 05226a63b777574aa4d53dc43e77ba9e22fee548
SHA512 fedde8ea883737925181eaf611aa75678254d1d6b48c43706c4b120c93604a0df4b80254f39990e1aa6c59e902dbac33ad2e3916dde872ca2e262b4f7e12db99
SSDEEP 6144:WFKz8sLkpankSsHP7th3QBULd3lAdD+213briFF1/0YbP+SnZuHH3fQLR:ZmXQldDF3vM1/l/ZuHH3Y9
TLSH
T1F4647B42A2B480B1D57111F0FABE3B5F883D38956F2486C773D4495CABE01E365FAB86
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

250712

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\batfuscator_win32\Release\batfuscator.pdb

d3d9

Direct3DCreate9

kernel32

QueryPerformanceFrequency GetProcAddress QueryPerformanceCounter GetModuleHandleA ExitProcess GlobalUnlock EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection WideCharToMultiByte ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar CloseHandle SetEvent

user32

OpenClipboard GetCursorPos GetCapture MessageBoxA DispatchMessageA GetWindowRect DestroyWindow ShowWindow DefWindowProcA CreateWindowExA SetLayeredWindowAttributes TranslateMessage PeekMessageA UnregisterClassA PostQuitMessage GetDesktopWindow RegisterClassExA UpdateWindow GetKeyState LoadCursorA CloseClipboard IsChild ScreenToClient ClientToScreen GetForegroundWindow EmptyClipboard GetClipboardData SetClipboardData SetCapture SetCursor GetClientRect SetCursorPos ReleaseCapture

comdlg32

GetOpenFileNameA

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow

xinput1_4

ord2 ord4

msvcp140

?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z _Query_perf_frequency _Thrd_sleep _Query_perf_counter _Xtime_get_ticks ??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@H@Z ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z ?_Xlength_error@std@@YAXPBD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ?always_noconv@codecvt_base@std@@QBE_NXZ ??Bid@locale@std@@QAEIXZ ?uncaught_exception@std@@YA_NXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ

vcruntime140

_CxxThrowException _except_handler4_common memset __current_exception_context __current_exception memmove memcpy memchr __std_exception_copy strstr __std_terminate __CxxFrameHandler3 __std_exception_destroy

api-ms-win-crt-stdio-l1-1-0

fflush __acrt_iob_func ftell __p__commode _get_stream_buffer_pointers _set_fmode _fseeki64 fsetpos ungetc setvbuf fgetpos fgetc fseek fputc fwrite _wfopen __stdio_common_vsprintf fclose __stdio_common_vsscanf fread

api-ms-win-crt-string-l1-1-0

strncpy

api-ms-win-crt-utility-l1-1-0

rand qsort srand

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh free malloc

api-ms-win-crt-runtime-l1-1-0

_get_narrow_winmain_command_line _initterm _initterm_e exit _exit _invalid_parameter_noinfo_noreturn _c_exit _register_thread_local_exe_atexit_callback _seh_filter_exe _cexit terminate _controlfp_s _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _crt_atexit _register_onexit_function _set_app_type _wassert

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-math-l1-1-0

_libm_sse2_acos_precise floor _CIfmod _CIatan2 _libm_sse2_pow_precise _libm_sse2_sin_precise _libm_sse2_sqrt_precise ceil _libm_sse2_cos_precise __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale