bubblegum[.]pink[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
bubblegum.pink.zip
Size 2.4MB
Sample260930-t11ppsx16l
SHA256 c3d911a12750ad0dc9665a05a0dcff0da2b98aeab256ec8d999b8e434e7ed71c
MD5 d18c6c18b5ed3ea02c6e1fcd51da0159
SHA1 be811e52961c2acad1b4387b3af6584f1b5fbbe9
SHA512 c156035e011348c1d1d8cbd2535619702f63e7cea27d6409f0d520ac6030599305acdf14adb0f1ed66504af8d6c1b2341740cedc2f55c50af954138a4601f056
SSDEEP 49152:mZW2A1YqWEeiXGbpy0/ZMfGzBHjTx09cHRNIb1fhtTiv+fN4tgSPmX:W7A1YlUCy0/qGVpIR1fhpHPSPmX
TLSH
T19BC53391D98BC8304616DC2032D49795E15F4FAFD298A3536AC0BF93CEA540E3835BFA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/build/bubblegum.pink.exe

File Explorer

bubblegum.pink.zip

.zip 2.4MB
build/bubblegum.pink.exe

.exe 3.8MB

bubblegum.pink.zip

SHA256 c3d911a12750ad0dc9665a05a0dcff0da2b98aeab256ec8d999b8e434e7ed71c
MD5 d18c6c18b5ed3ea02c6e1fcd51da0159
SHA1 be811e52961c2acad1b4387b3af6584f1b5fbbe9
SHA512 c156035e011348c1d1d8cbd2535619702f63e7cea27d6409f0d520ac6030599305acdf14adb0f1ed66504af8d6c1b2341740cedc2f55c50af954138a4601f056
SSDEEP 49152:mZW2A1YqWEeiXGbpy0/ZMfGzBHjTx09cHRNIb1fhtTiv+fN4tgSPmX:W7A1YlUCy0/qGVpIR1fhpHPSPmX
TLSH
T19BC53391D98BC8304616DC2032D49795E15F4FAFD298A3536AC0BF93CEA540E3835BFA
MD5 SHA1 SHA512 SSDEEP TLSH

Password

build/bubblegum.pink.exe

IMPHASH 8f71e91e3da751ba99c03218f41165cf
SHA256 09233974d97f17b67ec70a9f12d00c42b1a55daae6dbac15d7e278c2b038794c
MD5 b1e7e3d7afdbac8a7370cf2105afd0b4
SHA1 6242770bfb2bca813beb6db0a25c2547b1466407
SHA512 06265b672f43ac972cf94a8e1241e107d208a71ff9be133dbb6852c50ad794a8582090225f69815a40470c0f499859dcaaca8028db132222acc3f2d87265a7ca
SSDEEP 98304:/Dda911GCK0g2dBtgLpqNl5Yo3jI0quStH5+QsCZ:E91o0g2dBtgLpqDFjI0que0
TLSH
T1C906D05673D601E8E077D078CA47A617F7713408072096EBA3E8D9A51F67BE21B7EB02
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

Minor OS version

Major OS version

Entry point

1908412

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain D3D11CreateDevice

ntdll

VerSetConditionMask

winhttp

WinHttpSetTimeouts WinHttpSetOption WinHttpReadData WinHttpCrackUrl WinHttpQueryDataAvailable WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpOpen WinHttpReceiveResponse WinHttpConnect WinHttpQueryHeaders

kernel32

RaiseException AddVectoredExceptionHandler GetErrorMode ExitProcess SetUnhandledExceptionFilter Process32First TerminateProcess OpenProcess CreateToolhelp32Snapshot Process32Next GetCurrentProcessId ReadProcessMemory SetCurrentConsoleFontEx GetCurrentConsoleFontEx SetConsoleCP GetConsoleWindow SetConsoleOutputCP Thread32Next Thread32First SuspendThread ResumeThread Process32NextW Process32FirstW Module32FirstW GetThreadContext Module32NextW OpenThread IsDebuggerPresent CheckRemoteDebuggerPresent Module32Next GetProcessId Module32First VirtualAllocEx VirtualFreeEx GetExitCodeProcess SizeofResource LockResource LoadResource FindResourceW CreateFileW GetFileAttributesA HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection WaitForSingleObject SetErrorMode CreateFileMappingW MapViewOfFile UnmapViewOfFile AddDllDirectory SetDefaultDllDirectories QueryFullProcessImageNameW SetDllDirectoryW FormatMessageW ReleaseSRWLockExclusive AcquireSRWLockExclusive LocalFree LoadLibraryW SleepEx GetTickCount MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW GetFileSizeEx LoadLibraryExW GetCurrentProcess EnterCriticalSection VirtualProtectEx GetModuleHandleW SetConsoleCtrlHandler GetModuleFileNameA GetTickCount64 Sleep InterlockedPushEntrySList GetStdHandle SetConsoleTextAttribute GetConsoleScreenBufferInfo QueryPerformanceCounter FreeLibrary GetProcAddress IsDBCSLeadByte QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GetModuleHandleA GlobalUnlock WideCharToMultiByte VirtualQueryEx FlushInstructionCache GetCurrentThreadId InitializeCriticalSection LeaveCriticalSection GetModuleFileNameW SwitchToThread CreateEventW SetEvent GetSystemTimePreciseAsFileTime OutputDebugStringW GetSystemInfo GetLastError K32GetMappedFileNameA SetLastError GetCurrentThread VirtualProtect OutputDebugStringA MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock SetThreadPriority CreateEventA GetSystemDirectoryW CloseHandle CreateThread

user32

EmptyClipboard GetClipboardData ChangeDisplaySettingsA MonitorFromPoint DispatchMessageA GetWindowRect DestroyWindow GetSystemMetrics IsChild MessageBoxA DefWindowProcA CreateWindowExA SetLayeredWindowAttributes TranslateMessage PeekMessageA UnregisterClassA PostQuitMessage RegisterClassExA UpdateWindow GetWindowLongA GetWindowThreadProcessId SetWindowPos ShowWindow SetWindowLongA SetWindowTextA SetForegroundWindow IsWindowVisible IsWindow IsIconic GetAsyncKeyState FindWindowA SendInput DefWindowProcW GetKeyState GetMessageExtraInfo LoadCursorA SetClipboardData OpenClipboard CloseClipboard GetCursorPos ReleaseDC SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient GetDC

gdi32

GetDeviceCaps

advapi32

ConvertSidToStringSidA CryptEncrypt CryptImportKey CryptDestroyKey SystemFunction036 CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW OpenProcessToken CopySid SetSecurityInfo RegDeleteKeyA RegCreateKeyExA IsValidSid InitializeAcl GetTokenInformation GetLengthSid AddAccessAllowedAce

shell32

ShellExecuteA ShellExecuteW

ole32

CoCreateFreeThreadedMarshaler CoInitializeEx CoUninitialize CoTaskMemFree CoCreateInstance

msvcp140

?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z _Thrd_detach ??7ios_base@std@@QEBA_NXZ ?_Random_device@std@@YAIXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z _Xtime_get_ticks ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z _Cnd_do_broadcast_at_thread_exit ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_lock _Query_perf_counter _Mtx_unlock ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

winmm

waveOutPrepareHeader waveOutUnprepareHeader waveOutWrite timeBeginPeriod waveOutOpen waveOutReset waveOutClose

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertFreeCertificateChainEngine

ws2_32

__WSAFDIsSet select accept htonl setsockopt WSAIoctl sendto ioctlsocket gethostname recv htons freeaddrinfo recvfrom getaddrinfo getpeername connect bind WSACleanup WSAStartup WSASetLastError ntohs WSAGetLastError closesocket socket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt inet_ntop listen inet_pton getsockname ntohl

dnsapi

DnsQuery_A DnsFree

psapi

GetModuleInformation

wintrust

WinVerifyTrust

bcrypt

BCryptGenRandom

api-ms-win-core-synch-l1-1-0

AcquireSRWLockShared ReleaseSRWLockShared

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize InitOnceComplete WakeAllConditionVariable SleepConditionVariableSRW

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx FormatMessageA

api-ms-win-core-processenvironment-l1-1-0

GetCurrentDirectoryW

api-ms-win-core-file-l1-1-0

GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose SetFileInformationByHandle CreateDirectoryW

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

shlwapi

PathFindFileNameW

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove memcmp wcschr __current_exception __current_exception_context _CxxThrowException memset memcpy __std_exception_destroy __std_exception_copy __std_terminate strstr strchr strrchr __C_specific_handler wcsstr memchr

api-ms-win-crt-heap-l1-1-0

_callnewh realloc _set_new_mode malloc calloc free

api-ms-win-crt-runtime-l1-1-0

_invoke_watson _set_invalid_parameter_handler abort _crt_atexit _register_onexit_function _initialize_onexit_table _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _invalid_parameter_noinfo _exit _initterm_e _initterm terminate exit _beginthreadex _get_initial_narrow_environment _initialize_narrow_environment system _configure_narrow_argv _set_app_type _seh_filter_exe set_terminate _errno _resetstkoflw __sys_nerr __sys_errlist

api-ms-win-crt-math-l1-1-0

__setusermatherr ceilf log10f fmodf atan2f powf roundf floorf floor acosf _hypotf round nearbyint _fdclass _dclass _fdopen cosf expf tanf sqrtf fmod _dsign lround sinf lroundf atanf tanhf

api-ms-win-crt-stdio-l1-1-0

fwrite _wfopen _fseeki64 fsetpos ungetc _close setvbuf _get_stream_buffer_pointers _fileno fputs feof fgetpos __stdio_common_vsprintf __stdio_common_vfprintf _wopen _write ftell fgetc _read fseek _lseeki64 __acrt_iob_func fputc _popen _pclose fclose fgets fflush __stdio_common_vsprintf_s __stdio_common_vfscanf fread __p__commode _set_fmode __stdio_common_vsscanf fopen_s

api-ms-win-crt-time-l1-1-0

_localtime64 _time64 _gmtime64_s strftime _gmtime64 _localtime64_s

api-ms-win-crt-utility-l1-1-0

srand qsort rand

api-ms-win-crt-string-l1-1-0

isdigit isalnum iswspace towlower isxdigit tolower strncmp strpbrk _wcsicmp strncpy_s wcscpy_s _strdup wcsncmp strcpy_s strspn wcspbrk strcspn _wcsdup strcmp wcslen _stricmp isspace strncpy strlen wcsncpy

api-ms-win-crt-convert-l1-1-0

strtoull strtod wcstombs strtoul strtol strtof strtoll atoi

api-ms-win-crt-filesystem-l1-1-0

_fstat64 _wstat64 _lock_file _unlock_file _unlink

api-ms-win-crt-environment-l1-1-0

_dupenv_s getenv

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale ___lc_codepage_func

oleaut32

GetErrorInfo SysStringLen SysFreeString SetErrorInfo

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory