BKNnjrK3Oe[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
BKNnjrK3Oe.exe
Size 13.5MB
Sample261027-nnn79add37
SHA256 761878d9a4e62168b2f75a8ccbc688d0a9bef00439518217263c3fa4d1431b44
MD5 a08d32dee272340d5934b9f9f663f235
SHA1 eea47c0d35547584f70399c7065d9e249c3acb82
SHA512 404fa6245e5a15f752516c22dcc908231645a97d822d0e1cfb98c1cf3dbb7ec6ac167965a06817becaba5a6b29509b8dbaf137dbab478435dc09f01b28b5bb54
SSDEEP 393216:oUn0bq0RJsESy/4JwEjfn3aroX+OkfX+:oUn0pZ5LETn9X+OkfX
TLSH
T113E63361F33487F5D03BB278A482962BDB327C111B2055CBB7D2095A4FB7AE44A73729
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BKNnjrK3Oe.exe

File Explorer

BKNnjrK3Oe.exe

.exe 13.5MB

BKNnjrK3Oe.exe

IMPHASH ce61259c30940f3ed5798c990530b0d4
SHA256 761878d9a4e62168b2f75a8ccbc688d0a9bef00439518217263c3fa4d1431b44
MD5 a08d32dee272340d5934b9f9f663f235
SHA1 eea47c0d35547584f70399c7065d9e249c3acb82
SHA512 404fa6245e5a15f752516c22dcc908231645a97d822d0e1cfb98c1cf3dbb7ec6ac167965a06817becaba5a6b29509b8dbaf137dbab478435dc09f01b28b5bb54
SSDEEP 393216:oUn0bq0RJsESy/4JwEjfn3aroX+OkfX+:oUn0pZ5LETn9X+OkfX
TLSH
T113E63361F33487F5D03BB278A482962BDB327C111B2055CBB7D2095A4FB7AE44A73729
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

448992

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmSetWindowAttribute

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpSetTimeouts WinHttpSetOption WinHttpQueryDataAvailable

ole32

CoCreateInstance CoInitializeEx

advapi32

GetTokenInformation GetUserNameA OpenProcessToken

user32

TranslateMessage SetProcessDPIAware ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout GetClipboardData EmptyClipboard SetClipboardData CloseClipboard OpenClipboard GetWindowThreadProcessId GetClassNameA EnumWindows SetWindowLongPtrA GetWindowLongPtrA SetProcessDpiAwarenessContext LoadCursorA ScreenToClient MessageBoxW SetWindowTextW ReleaseDC GetDC UpdateWindow GetSystemMetrics ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW PostMessageW PeekMessageW DispatchMessageW

gdi32

GetDeviceCaps

shell32

ShellExecuteExA ShellExecuteA ShellExecuteW

kernel32

GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetTimeZoneInformation GetFileSizeEx SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleOutputCP GetFileType LCMapStringW CompareStringW LoadLibraryExW VirtualProtect HeapFree HeapAlloc UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetStdHandle ExitProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException GetProcessHeap SetStdHandle GetStringTypeW RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry CreateFileW GetModuleFileNameW CloseHandle QueryPerformanceCounter GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetTickCount64 GetModuleFileNameA MoveFileExW GetComputerNameA MultiByteToWideChar CreateToolhelp32Snapshot Process32First Process32Next GetLocalTime GetEnvironmentVariableA CreateDirectoryA CreateFileA DeleteFileA FlushFileBuffers ReadFile SetFileAttributesA WriteFile IsDebuggerPresent CheckRemoteDebuggerPresent GetLastError WaitForSingleObject Sleep TerminateProcess CreateProcessA FindClose FindFirstFileA GlobalAlloc GlobalUnlock GlobalLock GlobalFree OutputDebugStringA WideCharToMultiByte VerSetConditionMask QueryPerformanceFrequency FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA GetLocaleInfoA IsDBCSLeadByte ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetSystemTimeAsFileTime InitializeSListHead HeapSize HeapReAlloc SetEndOfFile WriteConsoleW GetCommandLineA FindNextFileA

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

Name

.text

Size

586KB

Virtual Size

585KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

12.9MB

Virtual Size

12.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

BKNnjrK3Oe.exe

d3d11

dwmapi

winhttp

ole32

advapi32

user32

gdi32

shell32

kernel32

imm32

d3dcompiler_47

generic