PATCHBloomAndDoom[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
PATCHBloomAndDoom.exe
Size 2.8MB
Sample260821-xaeakavhmg
SHA256 01495bdd0168282ca55932c206b1261cdcb5f45c260d928c0f8e3b1cadb67ac9
MD5 fe834a756102a77b5fa45967692d1386
SHA1 829f29728ed261d0c34b6659c1c3ea85a97f86b7
SHA512 cc024c782abe38065c947d7491f536f3eb09c8380bcb2d89df077ca04f3c6478ff76660ac1c08a1d2793c6908b07bc05d531561111092d46bd369fff409fb113
SSDEEP 49152:CneXsuncj1uatsEkKz88JZ/orcIqy/VYsUNAq+EJuWbwF46U8+M5PAU:Ce8uncLYXVXq+3OM5IU
TLSH
T198D58C51F3DBD0F2D95B1A7141A6A73B0920AF2513249AE7FB903F2F98347E1D836249
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PATCHBloomAndDoom.exe

File Explorer

PATCHBloomAndDoom.exe

.exe 2.8MB

PATCHBloomAndDoom.exe

IMPHASH 26f24f75c694c500385cf36907f82706
SHA256 01495bdd0168282ca55932c206b1261cdcb5f45c260d928c0f8e3b1cadb67ac9
MD5 fe834a756102a77b5fa45967692d1386
SHA1 829f29728ed261d0c34b6659c1c3ea85a97f86b7
SHA512 cc024c782abe38065c947d7491f536f3eb09c8380bcb2d89df077ca04f3c6478ff76660ac1c08a1d2793c6908b07bc05d531561111092d46bd369fff409fb113
SSDEEP 49152:CneXsuncj1uatsEkKz88JZ/orcIqy/VYsUNAq+EJuWbwF46U8+M5PAU:Ce8uncLYXVXq+3OM5IU
TLSH
T198D58C51F3DBD0F2D95B1A7141A6A73B0920AF2513249AE7FB903F2F98347E1D836249
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2182836

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\popcap\lawn\releasebeta\BloomAndDoom.pdb

kernel32

SetUnhandledExceptionFilter RaiseException GetCurrentDirectoryA SetCurrentDirectoryA GetModuleFileNameA LeaveCriticalSection EnterCriticalSection CreateFileA GetCurrentThreadId CloseHandle GetCurrentThread GetCurrentProcess GetLastError OutputDebugStringA LoadLibraryA GetProcAddress GetCurrentProcessId CreateFileMappingA MapViewOfFile WinExec FindFirstFileA FindNextFileA FindClose Sleep GetFileAttributesExA GetModuleHandleA GetTickCount IsDebuggerPresent SetEndOfFile SetEnvironmentVariableA CreateFileW GetLocaleInfoW WriteConsoleW InterlockedDecrement FreeLibrary GetVersionExA SetThreadPriority DeleteFileA MultiByteToWideChar GlobalUnlock GlobalLock GlobalAlloc GlobalFree GetCommandLineA CreateMutexA MulDiv FileTimeToSystemTime GetFileTime GetSystemDirectoryA VirtualQuery QueryPerformanceCounter QueryPerformanceFrequency GetThreadPriority InitializeCriticalSection DeleteCriticalSection VirtualProtect UnmapViewOfFile IsBadWritePtr CreateThread OpenFileMappingA SetErrorMode InterlockedIncrement GetWindowsDirectoryA LoadLibraryW GetCurrentDirectoryW GetFileSize LockResource LoadResource SizeofResource FindResourceA WideCharToMultiByte InterlockedCompareExchange InterlockedExchange GetLocaleInfoA RtlUnwind TerminateProcess UnhandledExceptionFilter GetSystemTimeAsFileTime GetTimeFormatA GetDateFormatA ExitProcess HeapAlloc HeapFree GetProcessHeap GetStartupInfoA ExitThread ResumeThread GetLocalTime GetDriveTypeA GetFullPathNameA HeapReAlloc CreateDirectoryA LCMapStringA LCMapStringW GetCPInfo CompareStringA CompareStringW GetStringTypeA GetStringTypeW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetACP GetOEMCP IsValidCodePage ReadFile WriteFile GetConsoleCP GetConsoleMode HeapSize GetTimeZoneInformation SetFilePointer SetHandleCount GetStdHandle GetFileType VirtualFree VirtualAlloc HeapDestroy HeapCreate FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW FlushFileBuffers GetUserDefaultLCID EnumSystemLocalesA IsValidLocale SetStdHandle WriteConsoleA GetConsoleOutputCP RemoveDirectoryA

user32

ShowWindow SystemParametersInfoA DestroyWindow PostMessageA GetCursorPos SetActiveWindow SetForegroundWindow GetWindowPlacement IsWindowEnabled ReleaseCapture ScreenToClient ClientToScreen CloseClipboard SetClipboardData EmptyClipboard OpenClipboard MessageBoxW ReleaseDC MoveWindow GetClientRect GetDC EndDialog GetDlgItem DialogBoxIndirectParamA SetCapture WindowFromPoint TranslateMessage DispatchMessageA PeekMessageA HideCaret SetWindowTextA GetWindowTextA GetClipboardData DefWindowProcW InvalidateRect GetSystemMetrics GetWindowRect DefWindowProcA EndPaint BeginPaint GetWindowLongA IsWindowVisible IsIconic ChangeDisplaySettingsA EnumWindows EnumDisplaySettingsA CreateCursor SetWindowLongA CreateWindowExA RegisterClassA LoadIconA RegisterWindowMessageA SetTimer AdjustWindowRect DestroyCursor DrawTextExA OffsetRect FillRect AdjustWindowRectEx GetWindowInfo GetMessageA IsDialogMessageA DrawTextA GetFocus GetSysColor GetSysColorBrush CreateWindowExW GetDesktopWindow DestroyCaret CreateCaret ShowCaret SetCaretPos SetFocus SetCursor LoadCursorA SendMessageA MessageBoxA GetActiveWindow

wininet

InternetCloseHandle InternetConnectA HttpQueryInfoA HttpSendRequestA HttpOpenRequestA InternetReadFile InternetOpenA

winmm

timeEndPeriod timeBeginPeriod mixerClose mixerGetControlDetailsA mixerGetLineControlsA mixerGetLineInfoA timeGetTime PlaySoundA mixerGetDevCapsA mixerOpen mixerSetControlDetails

wsock32

__WSAFDIsSet select WSACleanup closesocket recv WSAStartup socket inet_ntoa send WSAGetLastError connect htons gethostbyname ioctlsocket

gdi32

GetObjectA CreateFontIndirectA CreateFontA GetDeviceCaps GetStockObject CreateDIBSection TextOutA CreateCompatibleDC IntersectClipRect SetBkMode CreateSolidBrush DeleteDC SelectObject GetTextMetricsA GetTextExtentPoint32A DeleteObject SetTextColor

advapi32

RegDeleteValueA RegOpenKeyExA RegCreateKeyExA RegSetValueExA RegOpenKeyA RegQueryValueExA RegCloseKey

shell32

ShellExecuteA

ole32

CoCreateInstance CoInitialize

oleaut32

SysFreeString SysAllocString VariantClear