L4D2 BHop V4[.]2[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
L4D2 BHop V4.2.exe
Size 482KB
Sample260815-wlly4seq8w
SHA256 990463a41f8769f0c5a793c6d83f45d80b0b5566cb363971c94f46fc0e08e2ef
MD5 fe5e5d257ea93982a054ab46d951dff4
SHA1 f8a7bacbe562c67cadc466c649e3da2fbad29a1b
SHA512 7989d5d4a81123b57053694528bead1e63044f79706931b918bde7ca98d87996b06ccb71d115a7779931dea230eefe31666fd67da6d5cff0ad5d4cc880a3a5c9
SSDEEP 6144:GzdIEt1kCIABqXOAp70FF6afDj3AvQYlQPuqsqp9g2kz+ZZQV30:mI8+ei4zuUQAVkOZ
TLSH
T180A45C69A3AC03F4E1B7D178CE934401EB727846477196DF03A095B65F27AE09E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
L4D2 BHop V4.2.exe

File Explorer

L4D2 BHop V4.2.exe

.exe 482KB

L4D2 BHop V4.2.exe

IMPHASH fc1a4b64bf9b3dc289b3a23884ce3b3d
SHA256 990463a41f8769f0c5a793c6d83f45d80b0b5566cb363971c94f46fc0e08e2ef
MD5 fe5e5d257ea93982a054ab46d951dff4
SHA1 f8a7bacbe562c67cadc466c649e3da2fbad29a1b
SHA512 7989d5d4a81123b57053694528bead1e63044f79706931b918bde7ca98d87996b06ccb71d115a7779931dea230eefe31666fd67da6d5cff0ad5d4cc880a3a5c9
SSDEEP 6144:GzdIEt1kCIABqXOAp70FF6afDj3AvQYlQPuqsqp9g2kz+ZZQV30:mI8+ei4zuUQAVkOZ
TLSH
T180A45C69A3AC03F4E1B7D178CE934401EB727846477196DF03A095B65F27AE09E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

1234juanmataA

Minor OS version

Major OS version

Entry point

176468

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

SendMessageW DispatchMessageW TranslateMessage PostMessageW LoadCursorW GetWindowThreadProcessId EnumWindows PtInRect FillRect GetSysColorBrush GetSysColor WindowFromPoint ScreenToClient GetCursorPos MessageBoxW GetWindowRect GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW RedrawWindow InvalidateRect EndPaint BeginPaint ReleaseDC GetDC GetForegroundWindow DrawTextW KillTimer SetTimer ReleaseCapture MapVirtualKeyW GetKeyNameTextW GetAsyncKeyState IsWindowVisible SetWindowPos ShowWindow CreateWindowExW RegisterClassW PostQuitMessage DefWindowProcW GetMessageW

kernel32

GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetCommandLineA VirtualProtect FlsFree FlsSetValue FlsGetValue CloseHandle GetLastError Sleep OpenProcess GetTickCount ReadProcessMemory LocalFree FormatMessageW WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW FlsAlloc GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle CreateFileW HeapSize SetEndOfFile WriteConsoleW HeapFree HeapAlloc WriteFile GetStdHandle WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread MultiByteToWideChar GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceCounter ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable EncodePointer DecodePointer LCMapStringEx RtlUnwind GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess GetCurrentProcessId InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW

gdi32

SetTextColor SetBkMode SetBkColor SelectObject Rectangle GetStockObject DeleteObject CreateSolidBrush CreatePen CreateFontW

comctl32

InitCommonControlsEx

winmm

timeEndPeriod timeBeginPeriod

shell32

ShellExecuteW

Name

.text

Size

328KB

Virtual Size

328KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

128KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

L4D2 BHop V4.2.exe

user32

kernel32

gdi32

comctl32

winmm

shell32

generic