bdff003f47f176d4[.]bin[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
bdff003f47f176d4.bin.exe
Size 2.0MB
Sample261024-dzb2ysfv5s
SHA256 bdff003f47f176d4c685a032ffdb7db5e482c812bcd0c7e58acc76327f317a36
MD5 491fee22edfa785911d113c4118c7a30
SHA1 61b08489f490887c33c95bcc133041f138ef16ea
SHA512 773f565542378788c96d6b2d2ac83c095bab7a32aef55377c4b82911ada401afe7b0416419b01d36b1e315484f9b036d9f98159c6dde730d21ef26608c5dd21f
SSDEEP 24576:6+APnoYtzk6DwUGGD4UQ6ZbKvDuhxlu+W5LWH99FjaNNdGVqdOmTVIH06iy9FM:6Fno+I6NKUQ6xju++KH99FarFBIU6is
TLSH
T16B957C47E69580FCD49EC078C3579732EA22BC8D0920B6AB27D09B653E76F506F0DB19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bdff003f47f176d4.bin.exe

File Explorer

bdff003f47f176d4.bin.exe

.exe 2.0MB

bdff003f47f176d4.bin.exe

IMPHASH 8350bff92a4ce77b7f869c99c2e7eb1c
SHA256 bdff003f47f176d4c685a032ffdb7db5e482c812bcd0c7e58acc76327f317a36
MD5 491fee22edfa785911d113c4118c7a30
SHA1 61b08489f490887c33c95bcc133041f138ef16ea
SHA512 773f565542378788c96d6b2d2ac83c095bab7a32aef55377c4b82911ada401afe7b0416419b01d36b1e315484f9b036d9f98159c6dde730d21ef26608c5dd21f
SSDEEP 24576:6+APnoYtzk6DwUGGD4UQ6ZbKvDuhxlu+W5LWH99FjaNNdGVqdOmTVIH06iy9FM:6Fno+I6NKUQ6xju++KH99FarFBIU6is
TLSH
T16B957C47E69580FCD49EC078C3579732EA22BC8D0920B6AB27D09B653E76F506F0DB19
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

bcryptprimitives

ProcessPrng

advapi32

AdjustTokenPrivileges GetTokenInformation LookupPrivilegeValueW OpenProcessToken CloseServiceHandle ControlService CreateServiceW DeleteService EnumServicesStatusExW OpenSCManagerW OpenServiceW RegCloseKey RegCreateKeyExW RegDeleteValueW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW StartServiceW SystemFunction036

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

kernel32

CancelIo CancelIoEx CloseHandle CopyFileExW CreateDirectoryW CreateEventW CreateFileW CreateIoCompletionPort CreateProcessW CreateThread CreateWaitableTimerExW DeleteFileW DeviceIoControl DuplicateHandle FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsSetValue GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetOverlappedResult GetQueuedCompletionStatusEx GetTempPathW InitOnceBeginInitialize InitOnceComplete IsThreadAFiber OpenProcess PostQueuedCompletionStatus ReadFile ReadFileEx SetFileCompletionNotificationModes SetFileInformationByHandle SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee SetWaitableTimer Sleep SleepEx TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue WaitForMultipleObjects WaitForSingleObject WriteFile WriteFileEx AddVectoredExceptionHandler CompareStringOrdinal CreateFileMappingA CreateToolhelp32Snapshot FormatMessageW FreeEnvironmentStringsW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetProcAddress GetProcessHeap GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetTickCount64 GetWindowsDirectoryW GlobalLock GlobalMemoryStatusEx GlobalUnlock HeapAlloc HeapFree HeapReAlloc MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetConsoleCtrlHandler SetUnhandledExceptionFilter UnmapViewOfFile WriteConsoleW DeleteCriticalSection EnterCriticalSection InitializeCriticalSection LeaveCriticalSection RaiseException RtlUnwindEx VirtualProtect VirtualQuery __C_specific_handler

ntdll

NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError NtCreateNamedPipeFile

ws2_32

WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket recv send setsockopt shutdown

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject GetDIBits SelectObject

user32

CloseClipboard EmptyClipboard GetClipboardData GetCursorPos GetDC GetDesktopWindow GetSystemMetrics IsClipboardFormatAvailable OpenClipboard ReleaseDC SendInput SetCursorPos

bcrypt

BCryptGenRandom

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _fmode _fpreset _initterm _onexit abort calloc exit fprintf free fwrite malloc memcmp memcpy memmove memset signal strlen strncmp vfprintf wcslen

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

568KB

Virtual Size

568KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

544B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

bdff003f47f176d4.bin.exe

bcryptprimitives

advapi32

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

ws2_32

gdi32

user32

bcrypt

msvcrt

generic