BobLimt[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
BobLimt.exe
Size 1.3MB
Sample260809-1nvfgscf52
SHA256 e2acd03a6d4d8563c13437407d5923cfa249a3889555309db54c32ebae6a8074
MD5 e37f2f05f0d05cf851aa5c4fa1aa503c
SHA1 d40674f83f805c1369c23fb4be8574a15f1bc974
SHA512 4526e81593121c2abc1603d079e593182d8d2ce1f24c50178838a8e3a760b5936feaaf179dfb7d79f90af37140c00a805aa162ed6f79634070bbc5ad16330a49
SSDEEP 24576:y4JQBwgobe2MLvH42MoCnf82cb/cTGo4XoZa7RvRsygbGHtpxgFHe:yUQSq2MjIHfK/P+APgHe
TLSH
T1C9559E22B6A801FCD1B6D2B4DE664807D772784603346ADF03D09A671F23AE55E7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BobLimt.exe

File Explorer

BobLimt.exe

.exe 1.3MB

BobLimt.exe

IMPHASH 21b9bfc69556a7047213742d0598d462
SHA256 e2acd03a6d4d8563c13437407d5923cfa249a3889555309db54c32ebae6a8074
MD5 e37f2f05f0d05cf851aa5c4fa1aa503c
SHA1 d40674f83f805c1369c23fb4be8574a15f1bc974
SHA512 4526e81593121c2abc1603d079e593182d8d2ce1f24c50178838a8e3a760b5936feaaf179dfb7d79f90af37140c00a805aa162ed6f79634070bbc5ad16330a49
SSDEEP 24576:y4JQBwgobe2MLvH42MoCnf82cb/cTGo4XoZa7RvRsygbGHtpxgFHe:yUQSq2MjIHfK/P+APgHe
TLSH
T1C9559E22B6A801FCD1B6D2B4DE664807D772784603346ADF03D09A671F23AE55E7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

729856

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

GetWindowRect IsWindow EnableWindow GetWindowThreadProcessId GetWindowTextLengthW DefWindowProcW GetKeyState GetWindow DestroyWindow InflateRect IsWindowVisible SetWindowPos MessageBoxW SetWindowLongPtrW SetWindowRgn FillRect CreateWindowExW UnionRect ScreenToClient SendMessageW CallNextHookEx GetWindowLongPtrW GetAsyncKeyState OpenClipboard SetTimer DestroyIcon CloseClipboard EmptyClipboard RegisterClassW TrackMouseEvent SendDlgItemMessageW GetForegroundWindow UnhookWindowsHookEx EnumWindows IsRectEmpty SetLayeredWindowAttributes IntersectRect SetForegroundWindow GetClipboardData LoadIconW LoadCursorW GetClassNameW SetCapture EnumThreadWindows SetWindowsHookExW SetClipboardData SetCursor GetDlgItemInt GetClientRect UpdateLayeredWindow DrawTextW PostThreadMessageW DrawIconEx GetKeyNameTextW KillTimer PostQuitMessage UpdateWindow ReleaseCapture LoadImageW InvalidateRect GetCursorPos BeginPaint EndPaint GetWindowTextW MapVirtualKeyW GetDC keybd_event GetSystemMetrics mouse_event SetCursorPos ReleaseDC PostMessageW GetMessageW ShowWindow DispatchMessageW MessageBoxA TranslateMessage FindWindowW SetFocus

gdi32

BitBlt CreateCompatibleBitmap AddFontResourceExW SelectObject CreateDIBSection Arc CreateCompatibleDC GdiFlush CreateFontW GetStockObject CreateRoundRectRgn Polyline GetDeviceCaps CreateRectRgn DeleteDC GetTextExtentPoint32W SetTextColor SetBkMode LineTo CreatePen SelectClipRgn Polygon MoveToEx Ellipse DeleteObject CreateSolidBrush RoundRect IntersectClipRect GetPixel

advapi32

CryptCreateHash CryptGetHashParam CryptDestroyHash CryptGenRandom CryptAcquireContextW CryptReleaseContext CryptHashData

comdlg32

GetOpenFileNameW ChooseColorW

gdiplus

GdipSaveImageToFile GdipDeleteMatrix GdipCreatePen1 GdipCreateBitmapFromScan0 GdiplusStartup GdipAddPathLine GdipGetImageHeight GdipGetImageEncoders GdipResetClip GdipDrawImageRect GdipCloneImage GdipBitmapUnlockBits GdipDeleteBrush GdipScaleMatrix GdipCreateBitmapFromStream GdipAlloc GdipDrawImageRectI GdipAddPathBezier GdipDeletePath GdipCreateMatrix GdipDisposeImage GdipBitmapSetPixel GdipSetSmoothingMode GdipSetWorldTransform GdipSetClipPath GdipCreatePath GdipSetInterpolationMode GdipCreateSolidFill GdipFillPath GdipGetPathWorldBounds GdipGraphicsClear GdipCloneBitmapAreaI GdipSetPixelOffsetMode GdipAddPathEllipse GdipSetClipRectI GdipClosePathFigure GdipFree GdipDrawPath GdipTranslateMatrix GdipBitmapLockBits GdipCreateFromHDC GdipBitmapGetPixel GdipAddPathRectangle GdipCloneBrush GdipGetImageGraphicsContext GdipAddPathArc GdipGetImageEncodersSize GdipDeleteGraphics GdipSetCompositingMode GdipStartPathFigure GdipGetImageWidth GdipCreateBitmapFromFile GdipDeletePen

shell32

ShellExecuteExW ShellExecuteW Shell_NotifyIconW

winhttp

WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpWebSocketSend WinHttpWebSocketReceive WinHttpWebSocketClose WinHttpCrackUrl WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpQueryDataAvailable

winmm

mciSendStringW

ole32

CoCreateInstance CreateStreamOnHGlobal CoInitializeEx CoUninitialize

kernel32

DeleteFileW Sleep MulDiv GlobalUnlock QueryFullProcessImageNameW MoveFileExW GlobalLock GlobalFree GlobalAlloc GetCurrentThread SetEvent CreateEventW OpenProcess WaitForSingleObject SetThreadPriority CompareStringOrdinal GetProcessId TerminateProcess lstrlenW GetCurrentProcessId ResumeThread SuspendThread Thread32First Thread32Next GetModuleFileNameW WideCharToMultiByte GetTickCount64 GetCurrentThreadId FreeLibrary GetProcAddress LoadLibraryW CloseHandle Process32FirstW Process32NextW CreateToolhelp32Snapshot MultiByteToWideChar GetSystemFirmwareTable GetModuleHandleW GetLastError SetEndOfFile CreateProcessW CopyFileW GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle SetFileInformationByHandle CreateFile2 AreFileApisANSI CopyFile2 GetFileInformationByHandleEx LocalFree GetLocaleInfoEx FormatMessageA QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive OpenThread RtlUnwind WriteConsoleW HeapSize CreateFileW GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation HeapReAlloc ReadConsoleW ReadFile EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW VirtualProtect HeapFree GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapAlloc GetFileType SetFilePointerEx GetFileSizeEx UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetCommandLineW GetCommandLineA ExitProcess GetCurrentProcess WriteFile GetStdHandle IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException RtlPcToFileHeader CreateMutexW WaitForSingleObjectEx GetExitCodeThread RtlUnwindEx RtlLookupFunctionEntry GetStringTypeW GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime WakeAllConditionVariable GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection SleepConditionVariableSRW

Name

.text

Size

919KB

Virtual Size

918KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

206KB

Virtual Size

206KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

147KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

BobLimt.exe

user32

gdi32

advapi32

comdlg32

gdiplus

shell32

winhttp

winmm

ole32

kernel32

generic