BatwareFree[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
BatwareFree.exe
Size 762KB
Sample260811-ayk2pabe73
SHA256 6ca509ea2f9857bb5944acbef6677982d902bb6eabad32d908522214123479bd
MD5 0e5f0e34f4ee9e432caf200e9fd90732
SHA1 9d80010d8b891ac295ff76a60e90bf5ec4b9e600
SHA512 81a590207dc1915446915a0b989c281df8a7ffbced1ea0e32826844b057307455ff62854c2dbb3a621ee89a1ae225531d5febba1d666d325d4dd9703441ff60e
SSDEEP 12288:CvUyNPyiMdECJkrUGDFa5yG/5E3uyoRXnZwnjolZZ37aZBYb:Cvud5JwFaY6ZRZwnjWZZ37a3Y
TLSH
T1A1F4AF56F2A841F5D0B7D07AC596A607FAB2780903205ADF23E00E592FA76E46F7F311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BatwareFree.exe

File Explorer

BatwareFree.exe

.exe 762KB

BatwareFree.exe

IMPHASH 399bafd098465fcd2f1f2ba5aeced475
SHA256 6ca509ea2f9857bb5944acbef6677982d902bb6eabad32d908522214123479bd
MD5 0e5f0e34f4ee9e432caf200e9fd90732
SHA1 9d80010d8b891ac295ff76a60e90bf5ec4b9e600
SHA512 81a590207dc1915446915a0b989c281df8a7ffbced1ea0e32826844b057307455ff62854c2dbb3a621ee89a1ae225531d5febba1d666d325d4dd9703441ff60e
SSDEEP 12288:CvUyNPyiMdECJkrUGDFa5yG/5E3uyoRXnZwnjolZZ37aZBYb:Cvud5JwFaY6ZRZwnjWZZ37a3Y
TLSH
T1A1F4AF56F2A841F5D0B7D07AC596A607FAB2780903205ADF23E00E592FA76E46F7F311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

373792

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d9

Direct3DCreate9Ex

dwmapi

DwmExtendFrameIntoClientArea

kernel32

Sleep GetLastError Process32NextW LoadLibraryA QueryPerformanceFrequency Process32FirstW CloseHandle CreateThread Beep GetProcAddress ExitProcess lstrcmpiW QueryPerformanceCounter MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock FreeLibrary FreeEnvironmentStringsW GetEnvironmentStringsW HeapReAlloc GetOEMCP GetACP IsValidCodePage ReadConsoleW CreateProcessW GetExitCodeProcess WaitForSingleObject CreateToolhelp32Snapshot EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW VirtualProtect HeapFree GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapAlloc GetFileType SetFilePointerEx GetFileSizeEx UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetCommandLineA GetModuleFileNameW WriteFile IsProcessorFeaturePresent ReadFile FreeLibraryAndExitThread ExitThread GetModuleHandleExW TerminateProcess FlsFree OpenProcess GetModuleHandleA CreateFileW DeviceIoControl GetStdHandle GetCurrentProcess SetConsoleTitleA GetCommandLineW SetConsoleTextAttribute SetLastError GetStartupInfoW SetEnvironmentVariableW SetStdHandle GetProcessHeap HeapSize WriteConsoleW SetEndOfFile DeleteFileW FindClose LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW RtlUnwind FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle CreateFile2 AreFileApisANSI GetModuleHandleW GetFileInformationByHandleEx GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetStringTypeW GetCPInfo GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException FlsAlloc FlsGetValue FlsSetValue

user32

ScreenToClient ClientToScreen GetForegroundWindow SetCursor GetClientRect SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetWindowThreadProcessId GetKeyState GetWindowRect DestroyWindow SetWindowPos CallNextHookEx GetCursorPos ShowWindow IsWindow GetAsyncKeyState DispatchMessageW SetWindowsHookExA PeekMessageW MessageBoxA UnhookWindowsHookEx EnumWindows DefWindowProcA SetLayeredWindowAttributes TranslateMessage LoadIconW LoadCursorW ToUnicode SetWindowLongW RegisterClassExA UpdateWindow GetSystemMetrics

advapi32

OpenProcessToken CreateProcessAsUserW SetThreadToken GetTokenInformation SetTokenInformation LookupPrivilegeValueW RevertToSelf PrivilegeCheck DuplicateTokenEx

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

Name

.text

Size

569KB

Virtual Size

569KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

154KB

Virtual Size

154KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

BatwareFree.exe

d3d9

dwmapi

kernel32

user32

advapi32

imm32

generic