ByteBreaker V2_30283448[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ByteBreaker V2_30283448.exe
Size 695KB
Sample260913-p14n5sbd32
SHA256 bcb1db78d0562ea1c33f57dfa254d09877df0e2c12dc4038905df02144761aa8
MD5 f067b449ff414f0b6897bf29b004d9c9
SHA1 ae3de32992652d13cb2da554e52d520037766710
SHA512 269aea73db9c98e6217425c7c1049fe3405befe42c1720b737a007451462a7bfc06c126674afe0565c2a95c390a8c1639ee03a5cc32d4c2d45e4fd9b79e19c5e
SSDEEP 12288:f2Zgkw/BOOEAeeQrshOyqow07DLWYDbCq:OZp2BOO7YrshmT0xuq
TLSH
T185E48D16B66801FCE1B7D179C9924913F7B1B84B437197CF03A04AA6AF2B6E05E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
ByteBreaker V2_30283448.exe

File Explorer

ByteBreaker V2_30283448.exe

.exe 695KB

ByteBreaker V2_30283448.exe

IMPHASH ff4e7752f06f00f9ce77f26b38b1f57c
SHA256 bcb1db78d0562ea1c33f57dfa254d09877df0e2c12dc4038905df02144761aa8
MD5 f067b449ff414f0b6897bf29b004d9c9
SHA1 ae3de32992652d13cb2da554e52d520037766710
SHA512 269aea73db9c98e6217425c7c1049fe3405befe42c1720b737a007451462a7bfc06c126674afe0565c2a95c390a8c1639ee03a5cc32d4c2d45e4fd9b79e19c5e
SSDEEP 12288:f2Zgkw/BOOEAeeQrshOyqow07DLWYDbCq:OZp2BOO7YrshmT0xuq
TLSH
T185E48D16B66801FCE1B7D179C9924913F7B1B84B437197CF03A04AA6AF2B6E05E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

ba:a9:de:2b:92:4b:d4:51:74:b3:11:bb:bc:3f:9a:04:79:2a:7c:5a:1e:1b:a3:87:07:c5:87:35:41:6e:00:26

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=AN Soft,O=AN Soft,L=Bergen op Zoom,ST=North Brabant,C=NL

Chains

Jan 1, 0001

Subject

CN=SSL.com Code Signing Intermediate CA ECC R2,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

1c:cf:9d:67:cd:e2:19:ff:12:d9:9a:ff:36:82:e5:a7

Issuer

CN=SSL.com Root Certification Authority ECC,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 7, 2019 - Mar 3, 2034

Subject

CN=AN Soft,O=AN Soft,L=Bergen op Zoom,ST=North Brabant,C=NL

Serial Number

77:37:bb:9f:e3:4b:0f:1b:d5:af:da:23:3e:ea:b2:95

Issuer

CN=SSL.com Code Signing Intermediate CA ECC R2,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2026 - Jun 11, 2027

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Minor OS version

Major OS version

Entry point

343936

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Samim\Desktop\Installer\x64\Release\Installer.pdb

comctl32

ord410 ord413 InitCommonControlsEx

kernel32

SetEndOfFile WriteConsoleW HeapSize CreateFileW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW GetFileAttributesW HeapReAlloc ReadConsoleW ReadFile GetFileAttributesExW GetExitCodeProcess EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect GetFileType SetFilePointerEx GetModuleHandleW GetTempPathW CreateProcessW CreateThread CloseHandle GetLastError Sleep GetTimeZoneInformation WaitForSingleObject GetModuleFileNameW CreateDirectoryW MultiByteToWideChar FindClose GetFileSizeEx HeapFree GetConsoleMode GetConsoleOutputCP FlushFileBuffers UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext HeapAlloc WriteFile GetStdHandle GetProcAddress TerminateProcess ExitProcess GetCurrentProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlLookupFunctionEntry QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime GetStringTypeW WideCharToMultiByte GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer GetLocaleInfoEx LCMapStringEx WakeAllConditionVariable CompareStringEx GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead

user32

MessageBoxW SetWindowPos DestroyWindow PostMessageW DefWindowProcW CreateWindowExW GetWindowTextW EnableWindow EndPaint BeginPaint InvalidateRect SendMessageW PostQuitMessage DrawTextW GetClientRect SetWindowLongW LoadCursorW TranslateMessage FrameRect TrackMouseEvent DispatchMessageW ShowWindow RegisterClassExW GetWindowLongPtrW SetClassLongPtrW FillRect GetSystemMetrics UpdateWindow GetWindow GetMessageW GetWindowTextLengthW GetWindowLongW GetDC RegisterClassW ReleaseDC SetWindowTextW

gdi32

GetTextExtentPoint32W SelectObject CreateFontW GetStockObject SetTextColor SetBkMode LineTo CreatePen MoveToEx SetBkColor DeleteObject CreateSolidBrush RoundRect

advapi32

RegGetValueW RegSetValueExW RegCloseKey RegCreateKeyExW

shell32

SHGetKnownFolderPath ShellExecuteExW ShellExecuteW

ole32

CoTaskMemFree

urlmon

URLDownloadToFileW URLOpenBlockingStreamA

gdiplus

GdiplusStartup GdiplusShutdown GdipGetImageHeight GdipCloneImage GdipAlloc GdipLoadImageFromStream GdipGetImageWidth GdipDeleteGraphics GdipCreateFromHDC GdipFree GdipDisposeImage GdipDrawImageRectI

wininet

HttpOpenRequestA InternetCrackUrlA InternetOpenUrlA InternetOpenA InternetCloseHandle HttpSendRequestA InternetConnectA InternetReadFile InternetOpenW InternetOpenUrlW

Name

.text

Size

517KB

Virtual Size

516KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

130KB

Virtual Size

129KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ByteBreaker V2_30283448.exe

PE Signature issue

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

urlmon

gdiplus

wininet

generic