buddy[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
buddy.exe
Size 102KB
Sample261002-tw6edseb42
SHA256 cd3e46e41b1a36a9d53cb641176125c57f59545684777ece2a502bd7bcf56d21
MD5 dedbaba90bd550f5c4b90708076b13d1
SHA1 c35883e79a270c463074d0b0d265b75c8e493369
SHA512 a77ea84365d09ef0798f21cd2a48ee7054eca39b544e9f8d021ca53580393ddb0f5858f57c1efa869bb6d74c3e70d77673aeb664477f71cff189141b46262f9b
SSDEEP 1536:mvhqKoQvuILt5fsjjiskhhJcjgmCCCnaTE3jUvF40CdPc6t9ASuTyQluk2rNzyWT:mIKoQvuILtWF40CdFa7Va39l7i6
TLSH
T14CA3F7569B21EAFBE9018739D0E70324FB34F5010B520EDB6E515220AF63BE94EB7B45
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
buddy.exe

File Explorer

buddy.exe

.exe 102KB

buddy.exe

IMPHASH 089a25df9a3f332e31342f6410943577
SHA256 cd3e46e41b1a36a9d53cb641176125c57f59545684777ece2a502bd7bcf56d21
MD5 dedbaba90bd550f5c4b90708076b13d1
SHA1 c35883e79a270c463074d0b0d265b75c8e493369
SHA512 a77ea84365d09ef0798f21cd2a48ee7054eca39b544e9f8d021ca53580393ddb0f5858f57c1efa869bb6d74c3e70d77673aeb664477f71cff189141b46262f9b
SSDEEP 1536:mvhqKoQvuILt5fsjjiskhhJcjgmCCCnaTE3jUvF40CdPc6t9ASuTyQluk2rNzyWT:mIKoQvuILtWF40CdFa7Va39l7i6
TLSH
T14CA3F7569B21EAFBE9018739D0E70324FB34F5010B520EDB6E515220AF63BE94EB7B45
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdiplus

GdipCreateFont GdipCreateFontFamilyFromName GdipCreateFromHDC GdipCreatePen1 GdipCreateSolidFill GdipCreateStringFormat GdipDeleteBrush GdipDeleteFont GdipDeleteFontFamily GdipDeleteGraphics GdipDeletePen GdipDeleteStringFormat GdipDrawArcI GdipDrawLineI GdipDrawRectangleI GdipDrawString GdipFillEllipseI GdipFillPolygonI GdipFillRectangleI GdipGraphicsClear GdipSetSmoothingMode GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdiplusStartup

user32

CreateWindowExW DefWindowProcW DispatchMessageW GetCursorPos GetDC GetMessageW GetWindowRect LoadCursorW PostQuitMessage RegisterClassExW ReleaseCapture ReleaseDC SetCapture SetLayeredWindowAttributes SetTimer SetWindowPos ShowWindow TranslateMessage UpdateLayeredWindow UpdateWindow

gdi32

CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject SelectObject

libc++

_ZNSt11logic_errorC2EPKc _ZNSt12length_errorD1Ev _ZNSt3__112basic_stringIwNS_11char_traitsIwEENS_9allocatorIwEEEaSERKS5_ _ZSt9terminatev _ZTVN10__cxxabiv117__class_type_infoE _ZTVN10__cxxabiv120__si_class_type_infoE _ZTVSt12length_error _ZdlPv _Znwy __cxa_allocate_exception __cxa_begin_catch __cxa_free_exception __cxa_throw __gxx_personality_seh0

libunwind

_Unwind_Resume

msvcrt

_XcptFilter __getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _commode atexit _exit _fmode _initterm _time64 abort calloc exit fflush fprintf free malloc memcpy memmove rand setvbuf srand strlen strncmp vfprintf

kernel32

DeleteCriticalSection EnterCriticalSection GetLastError GetStartupInfoA InitializeCriticalSection IsDBCSLeadByte LeaveCriticalSection SetUnhandledExceptionFilter Sleep TlsGetValue VirtualProtect VirtualQuery

Name

.text

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

420B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

444B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

132B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/18

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/58

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/82

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/33

Size

512B

Virtual Size

432B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/47

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

buddy.exe

gdiplus

user32

gdi32

libc++

libunwind

msvcrt

kernel32

generic