bocchi_the_share[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
bocchi_the_share.exe
Size 6.1MB
Sample260925-nbbfmavaqf
SHA256 226281d4189567e24e3e5db7251910509c5d5651cfcfbb83118b9274b58c7245
MD5 bc9fcad35da24823445e8db1a793ceeb
SHA1 2be1e65938bfa4b3c4f5516457a961254263c5ae
SHA512 dc5b571bd1495f5f253c84453ff78f69760bda5afe6820658448869c2812f7a227d5e91c9c7268cb262bc56df32031ce17cdac5b70a70bc823e122a26774a65b
SSDEEP 49152:ghqXfS/l28GuDpoLV2oRc3nyHd+gpLbYWfmupkQCCoMwFX0UQXV6QXVqQXVTEHdP:PfYlSOezGGLZiMw107EbE7WVJkbs
TLSH
T1A2568D92F366A2EFC556C43082697237E672784F03347AE747D0AA712F51BD01E79B0A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bocchi_the_share.exe

File Explorer

bocchi_the_share.exe

.exe 6.1MB

bocchi_the_share.exe

IMPHASH ca7d0020b5e054863aee47dd55f5e002
SHA256 226281d4189567e24e3e5db7251910509c5d5651cfcfbb83118b9274b58c7245
MD5 bc9fcad35da24823445e8db1a793ceeb
SHA1 2be1e65938bfa4b3c4f5516457a961254263c5ae
SHA512 dc5b571bd1495f5f253c84453ff78f69760bda5afe6820658448869c2812f7a227d5e91c9c7268cb262bc56df32031ce17cdac5b70a70bc823e122a26774a65b
SSDEEP 49152:ghqXfS/l28GuDpoLV2oRc3nyHd+gpLbYWfmupkQCCoMwFX0UQXV6QXVqQXVTEHdP:PfYlSOezGGLZiMw107EbE7WVJkbs
TLSH
T1A2568D92F366A2EFC556C43082697237E672784F03347AE747D0AA712F51BD01E79B0A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3647056

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bocchi_the_share.pdb

bcryptprimitives

ProcessPrng

kernel32

HeapReAlloc AttachConsole AllocConsole GetUserDefaultUILanguage SetConsoleCtrlHandler CreateThread GetStringTypeW CreateEventW CompareStringW CreateWaitableTimerExW GetCPInfo GetOEMCP GetACP IsValidCodePage RtlPcToFileHeader RaiseException EncodePointer CreateMutexW SetThreadErrorMode IsDebuggerPresent HeapFree GetSystemTimeAsFileTime GetModuleHandleExW FlsFree FlsSetValue FlsGetValue FlsAlloc TerminateProcess GetProcessHeap TlsFree TlsSetValue QueryPerformanceCounter GetLocalTime TlsGetValue GetModuleHandleW TlsAlloc IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceFrequency OutputDebugStringW LCMapStringW HeapSize SetWaitableTimer ReleaseMutex WaitForSingleObjectEx GetCurrentProcess SetLastError SetThreadStackGuarantee GetCurrentProcessId SetHandleInformation GetCurrentThreadId Sleep GlobalFree SetThreadPriority GetCurrentThread SwitchToThread WaitForMultipleObjects GetProcAddress SetWaitableTimerEx SetEvent FreeLibrary VirtualProtect GetModuleHandleA LoadLibraryExW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetModuleFileNameW ExitProcess GlobalLock GlobalUnlock LoadLibraryExA GlobalAlloc FormatMessageW GetConsoleOutputCP WaitForSingleObject GetConsoleMode CloseHandle GetStdHandle WriteConsoleW GetLastError SetStdHandle RtlLookupFunctionEntry lstrlenW WideCharToMultiByte LoadLibraryA CreateMutexA HeapAlloc MultiByteToWideChar InitializeCriticalSectionAndSpinCount GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW RtlUnwindEx FindNextFileW GetFullPathNameW InitializeSListHead FindClose RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter DeleteFileW SetFilePointerEx FlushFileBuffers InitializeCriticalSectionEx GetFileType SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW CreateFileW SetFileTime GetCommandLineA WriteFile SetFileInformationByHandle GetFileInformationByHandle DeleteCriticalSection LeaveCriticalSection GetFileInformationByHandleEx FindFirstFileExW EnterCriticalSection CreateDirectoryW AddVectoredExceptionHandler MoveFileExW

ws2_32

WSACleanup WSAStartup getsockname accept listen freeaddrinfo recvfrom getaddrinfo closesocket sendto recv ioctlsocket WSAEventSelect WSAPoll WSAIoctl bind setsockopt WSASocketW connect WSAGetLastError send WSADuplicateSocketW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

avrt

AvRevertMmThreadCharacteristics AvSetMmThreadCharacteristicsW

ntdll

RtlNtStatusToDosError NtWriteFile NtReadFile

oleaut32

SysStringLen GetErrorInfo SysFreeString

user32

SetCapture GetWindowRect GetDpiForWindow SetWindowPos SetWindowPlacement GetWindowPlacement AdjustWindowRectExForDpi GetMonitorInfoW MonitorFromWindow SetCursor GetWindowLongPtrW SetWindowLongPtrW CreateWindowExW RegisterWindowMessageW DestroyMenu TrackPopupMenu GetCursorPos AppendMenuW CreatePopupMenu OpenClipboard GetClipboardData RegisterClassExW LoadIconW LoadCursorW DisplayConfigGetDeviceInfo ReleaseCapture CloseClipboard EmptyClipboard SetClipboardData MonitorFromPoint GetDisplayConfigBufferSizes TrackMouseEvent SetProcessDpiAwarenessContext FindWindowW PostMessageW DefWindowProcW DestroyWindow PeekMessageW MsgWaitForMultipleObjectsEx DispatchMessageW TranslateMessage QueryDisplayConfig SetForegroundWindow ShowWindow GetClientRect

shell32

Shell_NotifyIconW

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute

winhttp

WinHttpConnect WinHttpOpenRequest WinHttpSetTimeouts WinHttpReceiveResponse WinHttpQueryHeaders WinHttpOpen WinHttpCloseHandle WinHttpQueryDataAvailable WinHttpReadData WinHttpSendRequest

iphlpapi

GetAdaptersAddresses

ole32

CoCreateInstance CoInitializeEx CoUninitialize

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

mmdevapi

ActivateAudioInterfaceAsync

advapi32

RegCreateKeyExW RegSetValueExW RegGetValueW RegCloseKey

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

Name

.text

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

52KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

293KB

Virtual Size

293KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

bocchi_the_share.exe

bcryptprimitives

kernel32

ws2_32

api-ms-win-core-synch-l1-2-0

avrt

ntdll

oleaut32

user32

shell32

dwmapi

winhttp

iphlpapi

ole32

d3d11

dxgi

mmdevapi

advapi32

api-ms-win-shcore-scaling-l1-1-1

generic