Trojan[.]BUG32[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
Trojan.BUG32.zip
Size 2.5MB
Sample260816-tx24cs1hrf
SHA256 fab74fe6b288e4de3ffc2ad3794438671ae23ed9c69f6f28ce5baea1e7a07123
MD5 3c19dad82c11efaafa43e3856c123263
SHA1 bf313b340c992db58448fa29784e25362e84543a
SHA512 61edf8e4f8b310ba33781245faf20321ca0d526f0a0bb0d6d2747858b21e17d38d7e08a805a157b4e7c79c2e09ce874fbaf9d635fe9fe4b2ddac40890849aa42
SSDEEP 49152:xvnqmi6yLK3kXIw1GI3zOyZOfR99I3tjgeZAAOsuiX1WTvpRrVWJB2:EFLK3wIw3s5I3tcRAOom5WJB2
TLSH
T168C5330155A15DEBE6C2F8D04268EED49593FEC6CC83B24022A57DF349E4B41EB187BE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Trojan.BUG32.exe

File Explorer

Trojan.BUG32.zip

.zip 2.5MB
Trojan.BUG32.exe

.exe 3.0MB

Trojan.BUG32.zip

SHA256 fab74fe6b288e4de3ffc2ad3794438671ae23ed9c69f6f28ce5baea1e7a07123
MD5 3c19dad82c11efaafa43e3856c123263
SHA1 bf313b340c992db58448fa29784e25362e84543a
SHA512 61edf8e4f8b310ba33781245faf20321ca0d526f0a0bb0d6d2747858b21e17d38d7e08a805a157b4e7c79c2e09ce874fbaf9d635fe9fe4b2ddac40890849aa42
SSDEEP 49152:xvnqmi6yLK3kXIw1GI3zOyZOfR99I3tjgeZAAOsuiX1WTvpRrVWJB2:EFLK3wIw3s5I3tcRAOom5WJB2
TLSH
T168C5330155A15DEBE6C2F8D04268EED49593FEC6CC83B24022A57DF349E4B41EB187BE
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

Trojan.BUG32.exe

IMPHASH d7ee0bec939bda9b20c9cb9dcb985e30
SHA256 817a695e53a1d6e24f2c701751b4d18468f20698f30fada420dfba6e21a09797
MD5 149cc2ec1900cb778afb50d8026eadf5
SHA1 a7bc1bbc7bdc970757ec369ef0b51dc53989f131
SHA512 d617654478beb6325d86c108cddaff8f8d658a235d26b8e0282ed85dca826bdb62b0b67e749c7cd421dbae1d98084220e2f4d5779badb8fd7ab07ff333a35553
SSDEEP 49152:Or2U5IahDUGN97rkqOAackLjQ0rZEAh3oA6wHE+K60Kk0aCLkfAZKt0OJTcL:4H2ahFNNrg3QbQoA6wHEnFN4IJu
TLSH
T195E501C3E1419AA0C8154E764C266D9903773E9BEF866B2B3044FA6674F3183AB757C3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

memset strncmp memmove strncpy strstr _strnicmp _stricmp strlen strcmp sprintf fabs ceil malloc floor free fclose memcpy strcpy tolower

kernel32

GetModuleHandleA HeapCreate RemoveDirectoryA GetTempFileNameA GetShortPathNameA GetWindowsDirectoryA GetSystemDirectoryA HeapDestroy ExitProcess GetExitCodeProcess GetNativeSystemInfo FindResourceA LoadResource SizeofResource HeapAlloc HeapFree Sleep LoadLibraryA GetProcAddress FreeLibrary GetCurrentThreadId GetCurrentProcessId CloseHandle InitializeCriticalSection GetCommandLineA GetModuleFileNameA GetEnvironmentVariableA SetEnvironmentVariableA GetCurrentProcess TerminateProcess SetUnhandledExceptionFilter EnterCriticalSection LeaveCriticalSection GetVersionExA HeapReAlloc SetLastError TlsAlloc GetCurrentDirectoryA SetCurrentDirectoryA SetFileAttributesA DeleteFileA GetTempPathA CreateDirectoryA WriteFile CreateFileA SetFilePointer ReadFile DeleteCriticalSection

user32

CharLowerA MessageBoxA SendMessageA PostMessageA GetWindowThreadProcessId IsWindowVisible GetWindowLongA GetForegroundWindow IsWindowEnabled EnableWindow EnumWindows SetWindowPos DestroyWindow GetDC GetWindowTextLengthA GetWindowTextA SetRect DrawTextA GetSystemMetrics ReleaseDC GetSysColor GetSysColorBrush CreateWindowExA CallWindowProcA SetWindowLongA SetFocus RedrawWindow RemovePropA DefWindowProcA SetPropA GetParent GetPropA GetWindow SetActiveWindow UnregisterClassA DestroyAcceleratorTable LoadIconA LoadCursorA RegisterClassA AdjustWindowRectEx ShowWindow CreateAcceleratorTableA PeekMessageA MsgWaitForMultipleObjects GetMessageA GetActiveWindow TranslateAcceleratorA TranslateMessage DispatchMessageA GetFocus GetClientRect FillRect EnumChildWindows DefFrameProcA GetWindowRect IsChild GetClassNameA GetKeyState DestroyIcon RegisterWindowMessageA

gdi32

GetStockObject SelectObject SetBkColor SetTextColor GetTextExtentPoint32A CreateSolidBrush DeleteObject GetObjectA CreateCompatibleDC GetDIBits DeleteDC GetObjectType CreateDIBSection BitBlt CreateBitmap SetPixel

comctl32

InitCommonControlsEx

ole32

CoInitialize CoTaskMemFree RevokeDragDrop

shell32

ShellExecuteExA

winmm

timeBeginPeriod

shlwapi

PathQuoteSpacesA PathRenameExtensionA PathAddBackslashA PathUnquoteSpacesA