ByteBreaker V1_83236836[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ByteBreaker V1_83236836.exe
Size 756KB
Sample261104-2qfwjsdz2w
SHA256 bd1f1619f850be8c84ae0acdd0bb7ff3d88b8cb5647877c078d7805d7a55582f
MD5 280603b04aeadbb0d42f6043354923cd
SHA1 932e7cce8f6cde321f2288ccaaeb8ae5d84ab26d
SHA512 d533f6e2ab5e344135d300a418aa337a9282c5e59698838a9ce940cea92c76e82b10f238afe9464991923e5ca2fb3117794589c5b42b0ead2f0aeac23cedb16c
SSDEEP 12288:+p0GRlotsaT7ndqumblBUWgWlNMO5+XCTeGYaofXw/H3lkB+r5owVWq3Kgndor4q:6lydJ2J4Y/CVb0n3mmp7w
TLSH
T1A9F48E36B6AC41F9D173E179C9960506F7F27846133196DB43A08AAA5F2B6F41F3F220
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
ByteBreaker V1_83236836.exe

File Explorer

ByteBreaker V1_83236836.exe

.exe 756KB

ByteBreaker V1_83236836.exe

IMPHASH b3eb077da70cf3699e3dc8149d29c2be
SHA256 bd1f1619f850be8c84ae0acdd0bb7ff3d88b8cb5647877c078d7805d7a55582f
MD5 280603b04aeadbb0d42f6043354923cd
SHA1 932e7cce8f6cde321f2288ccaaeb8ae5d84ab26d
SHA512 d533f6e2ab5e344135d300a418aa337a9282c5e59698838a9ce940cea92c76e82b10f238afe9464991923e5ca2fb3117794589c5b42b0ead2f0aeac23cedb16c
SSDEEP 12288:+p0GRlotsaT7ndqumblBUWgWlNMO5+XCTeGYaofXw/H3lkB+r5owVWq3Kgndor4q:6lydJ2J4Y/CVb0n3mmp7w
TLSH
T1A9F48E36B6AC41F9D173E179C9960506F7F27846133196DB43A08AAA5F2B6F41F3F220
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

31:68:3f:2d:6e:4b:a4:6d:60:74:99:cb:31:5c:c0:8a:65:c4:a9:b1:13:ef:c4:69:b6:9a:05:bc:74:6c:c7:ba

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=AN Soft,O=AN Soft,L=Bergen op Zoom,ST=North Brabant,C=NL

Chains

Jan 1, 0001

Subject

CN=SSL.com Code Signing Intermediate CA ECC R2,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

1c:cf:9d:67:cd:e2:19:ff:12:d9:9a:ff:36:82:e5:a7

Issuer

CN=SSL.com Root Certification Authority ECC,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 7, 2019 - Mar 3, 2034

Subject

CN=AN Soft,O=AN Soft,L=Bergen op Zoom,ST=North Brabant,C=NL

Serial Number

77:37:bb:9f:e3:4b:0f:1b:d5:af:da:23:3e:ea:b2:95

Issuer

CN=SSL.com Code Signing Intermediate CA ECC R2,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2026 - Jun 11, 2027

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Minor OS version

Major OS version

Entry point

398336

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Samim\Desktop\Installer\x64\Release\Installer.pdb

comctl32

ord410 ord413 InitCommonControlsEx

kernel32

GetModuleHandleW SetEndOfFile WriteConsoleW HeapSize CreateFileW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA FindNextFileW FindFirstFileExW FindClose GetFileAttributesW HeapReAlloc GetACP IsValidCodePage ReadConsoleW ReadFile GetFileAttributesExW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect GetFileType SetFilePointerEx GetFileSizeEx CreateDirectoryW GetExitCodeProcess GetTempFileNameW CreateProcessW CreateThread CloseHandle DeleteFileW GetLastError Sleep GetOEMCP WaitForSingleObject GetTempPathW GetModuleFileNameW MultiByteToWideChar GetTimeZoneInformation HeapFree GetConsoleMode GetConsoleOutputCP FlushFileBuffers UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext HeapAlloc WriteFile GetStdHandle GetProcAddress TerminateProcess ExitProcess GetCurrentProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException RtlUnwind RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead QueryPerformanceCounter QueryPerformanceFrequency GetStringTypeW WideCharToMultiByte GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer GetLocaleInfoEx LCMapStringEx WakeAllConditionVariable CompareStringEx GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime

user32

MessageBoxW SetWindowPos DestroyWindow PostMessageW DefWindowProcW CreateWindowExW GetWindowTextW EnableWindow EndPaint BeginPaint InvalidateRect SendMessageW PostQuitMessage DrawTextW GetClientRect SetWindowLongW LoadCursorW TranslateMessage FrameRect TrackMouseEvent DispatchMessageW ShowWindow RegisterClassExW GetWindowLongPtrW SetClassLongPtrW FillRect GetSystemMetrics UpdateWindow GetWindow GetMessageW GetWindowTextLengthW GetWindowLongW GetDC RegisterClassW ReleaseDC SetWindowTextW

gdi32

GetTextExtentPoint32W SelectObject CreateFontW GetStockObject SetTextColor SetBkMode LineTo CreatePen MoveToEx SetBkColor DeleteObject CreateSolidBrush RoundRect

advapi32

RegGetValueW RegSetValueExW RegCloseKey RegCreateKeyExW

shell32

SHGetKnownFolderPath ShellExecuteExW ShellExecuteW

ole32

CoTaskMemFree

urlmon

URLDownloadToFileW URLOpenBlockingStreamA

gdiplus

GdiplusStartup GdiplusShutdown GdipGetImageHeight GdipCloneImage GdipAlloc GdipLoadImageFromStream GdipGetImageWidth GdipDeleteGraphics GdipCreateFromHDC GdipFree GdipDisposeImage GdipDrawImageRectI

wininet

HttpOpenRequestA InternetCrackUrlA InternetOpenUrlA InternetOpenA InternetCloseHandle HttpSendRequestA InternetReadFile InternetOpenUrlW InternetOpenW InternetConnectA

Name

.text

Size

573KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

135KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ByteBreaker V1_83236836.exe

PE Signature issue

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

urlmon

gdiplus

wininet

generic