BloodyWare[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
BloodyWare.exe
Size 16.1MB
Sample261014-va9qcsvz3l
SHA256 0ec8b5e010a707caaf08b6d1f0ca8fbea693e6c3197b5edede178bf6ed4ab145
MD5 05653d5a88292899ef367b5ef5e1af98
SHA1 6cf1caa8bdc3bde4e5d2a86d755fe5a5a91b1c39
SHA512 e83356325db38b1540f2dca73ea57feab0d6ef68bd10ccf3cbee576bc4a652d0fe4768f99c207edf51fadc0fca6cb77634bada1e615450136c08af4bcba4e2cd
SSDEEP 49152:CV6n5zSMjE+Hxn2rVMeulGQYIP9iKInWGS1/zcAt5pBAHnqyrqvY/dp3vMl1ErWr:LAMjhIjo1aq2v1vZv7KXNfo1qHp
TLSH
T13807B647EB7640C2D1BAC0399652E62BFCB1349AC375A7DBA7415F061B62BE0AD3D301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BloodyWare.exe

File Explorer

BloodyWare.exe

.exe 16.1MB

BloodyWare.exe

IMPHASH 69eb099f00ec03ce08f4e9b4566bd351
SHA256 0ec8b5e010a707caaf08b6d1f0ca8fbea693e6c3197b5edede178bf6ed4ab145
MD5 05653d5a88292899ef367b5ef5e1af98
SHA1 6cf1caa8bdc3bde4e5d2a86d755fe5a5a91b1c39
SHA512 e83356325db38b1540f2dca73ea57feab0d6ef68bd10ccf3cbee576bc4a652d0fe4768f99c207edf51fadc0fca6cb77634bada1e615450136c08af4bcba4e2cd
SSDEEP 49152:CV6n5zSMjE+Hxn2rVMeulGQYIP9iKInWGS1/zcAt5pBAHnqyrqvY/dp3vMl1ErWr:LAMjhIjo1aq2v1vZv7KXNfo1qHp
TLSH
T13807B647EB7640C2D1BAC0399652E62BFCB1349AC375A7DBA7415F061B62BE0AD3D301
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

108226

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Vexor\Documents\BloodyWare\vesta-main\vesta-main\build\bin\vesta.pdb

d3d11

D3D11CreateDevice

d3dcompiler_47

D3DCompile

ole32

CoUninitialize CoInitializeEx CoCreateInstance

dxgi

CreateDXGIFactory1

dwmapi

DwmGetWindowAttribute DwmGetColorizationColor DwmIsCompositionEnabled DwmExtendFrameIntoClientArea DwmEnableBlurBehindWindow

dcomp

DCompositionCreateDevice

winmm

timeBeginPeriod timeEndPeriod

ntdll

RtlCaptureStackBackTrace RtlPcToFileHeader VerSetConditionMask RtlUnwindEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwind

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

RevertToSelf RegOpenKeyExA RegCloseKey RegOpenKeyExW RegQueryValueExW OpenProcessToken GetTokenInformation CreateProcessAsUserW SetThreadToken DuplicateTokenEx PrivilegeCheck RegQueryValueExA LookupPrivilegeValueW SetTokenInformation

shell32

ShellExecuteExW

kernel32

CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP SetFilePointerEx ReadConsoleW GetExitCodeProcess CreatePipe SetConsoleCtrlHandler GetCommandLineA CloseHandle GetLastError WaitForSingleObject CreateMutexW ExitProcess SetWaitableTimer CreateWaitableTimerExW Sleep CreateWaitableTimerW SwitchToThread GetCurrentThread SetThreadPriority SetThreadInformation CreateDirectoryW CreateFileW GetFileSizeEx SetEndOfFile SetFilePointer WriteFile GetTempPathW GetCurrentProcessId GetTickCount64 MoveFileExW OpenProcess QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW VirtualQueryEx ReadProcessMemory CompareStringOrdinal MultiByteToWideChar Module32FirstW Module32NextW GetEnvironmentVariableW QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId GetModuleFileNameW GetProcAddress LoadLibraryExA WideCharToMultiByte OutputDebugStringW SetLastError GetModuleHandleW GetProcessTimes GetCurrentProcess GetSystemInfo GetSystemTimeAsFileTime lstrcmpW GetStdHandle GetConsoleMode SetConsoleMode SetConsoleTitleA CreateProcessW GlobalAlloc GlobalUnlock GlobalLock GlobalFree FreeLibrary GetModuleHandleA LoadLibraryA GetTimeZoneInformation GetCommandLineW lstrcmpiW GetModuleFileNameA FormatMessageA CreateFileA ReadFile HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA DuplicateHandle WriteConsoleW GetFileType FreeLibraryAndExitThread ResumeThread ExitThread CreateThread HeapValidate HeapSize TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount LoadLibraryExW InterlockedFlushSList InterlockedPushEntrySList VirtualQuery InitializeSListHead GetStartupInfoW IsDebuggerPresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo CompareStringEx GetStringTypeW LCMapStringEx CloseThreadpoolWait SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CreateThreadpoolTimer GetCurrentProcessorNumber FlushProcessWriteBuffers HeapQueryInformation CreateSemaphoreExW CreateEventExW InitOnceExecuteOnce DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection IsProcessorFeaturePresent GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns RaiseException InitOnceComplete InitOnceBeginInitialize CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW CopyFileW CreateDirectoryExW DeviceIoControl AreFileApisANSI SetFileTime SetFileInformationByHandle SetFileAttributesW GetFullPathNameW GetFinalPathNameByHandleW GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW GetDiskFreeSpaceExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose GetCurrentDirectoryW SetCurrentDirectoryW GetLocaleInfoEx LocalFree WakeConditionVariable TryAcquireSRWLockShared GetTimeFormatW DeleteFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetLocaleInfoA SetStdHandle GetDateFormatW VirtualProtect IsThreadAFiber FlsFree FlsSetValue FlsGetValue FlsAlloc ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW WaitForSingleObjectEx GetExitCodeThread GetNativeSystemInfo ReleaseSRWLockShared AcquireSRWLockShared TryAcquireSRWLockExclusive

user32

SendInput GetMessageW GetClassNameA SetProcessDPIAware ReleaseDC GetDC IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetClipboardData EmptyClipboard SetClipboardData CloseClipboard OpenClipboard UnhookWinEvent SetWinEventHook MonitorFromRect GetClassNameW EnumWindows IntersectRect IsIconic IsWindowVisible GetWindowPlacement SetWindowPos GetCursorInfo GetDpiForWindow GetMonitorInfoW MonitorFromWindow EnumDisplaySettingsW LoadCursorA GetWindow EnumThreadWindows GetParent SetWindowLongPtrW SetWindowsHookExW WindowFromPoint ScreenToClient IsWindowEnabled MsgWaitForMultipleObjectsEx GetKeyboardState SetWindowDisplayAffinity SetLayeredWindowAttributes ShowWindow DestroyWindow CreateWindowExW GetClassInfoExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW PostMessageW PeekMessageW DispatchMessageW TranslateMessage GetKeyboardLayout ToUnicodeEx MapVirtualKeyW GetKeyNameTextW GetWindowThreadProcessId GetForegroundWindow GetAncestor GetGUIThreadInfo FindWindowW ClientToScreen GetCursorPos SetCursorPos IsWindow GetClientRect GetAsyncKeyState SetProcessDpiAwarenessContext ClipCursor MessageBoxW PostThreadMessageW UnhookWindowsHookEx GetWindowLongPtrW CallNextHookEx SetCursor

gdi32

CreateRectRgn GetDeviceCaps DeleteObject

imm32

ImmSetCompositionWindow ImmGetContext ImmReleaseContext ImmSetCandidateWindow

Name

.text

Size

11.4MB

Virtual Size

11.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

708KB

Virtual Size

939KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

671KB

Virtual Size

671KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

92KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

BloodyWare.exe

d3d11

d3dcompiler_47

ole32

dxgi

dwmapi

dcomp

winmm

ntdll

comdlg32

advapi32

shell32

kernel32

user32

gdi32

imm32

generic