b0aware[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

Reason

scan timeout

General

Target
b0aware.exe
Size 123.0MB
Sample261110-2ffg2abh66
SHA256 30bac9ad18dc592aba730465be43613e45b606fa8feac570c4d2677452e992d4
MD5 9fc52d65a0a85d953069acac1b383d77
SHA1 b53896db7bef2c80902874e5a4ded14e071ed56d
SHA512 e215a2f8f8e99fc0d9de637f537fbc128a6aa3b9fbfe6ac89698727c0ea361be6c36423c57ebee41f765f085e91dc77853024822e2b2b14ddf6e9fea52b69a78
SSDEEP 3145728:cwiVhiDQbm1nGp/EHv/dNTyEYTsrBeLDQt1L6NSkR88i:cfhoQbm1nKsnSEYoBeLstsQkO5
TLSH
T1F7583343E2A3A0E8C16FD1348662A733FA31B85955352E7E1BD4CB342F31E90566EF25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b0aware.exe

File Explorer

b0aware.exe

.exe 123.0MB

b0aware.exe

IMPHASH 9ec74ca85c6ef12c240e95ac6412f22c
SHA256 30bac9ad18dc592aba730465be43613e45b606fa8feac570c4d2677452e992d4
MD5 9fc52d65a0a85d953069acac1b383d77
SHA1 b53896db7bef2c80902874e5a4ded14e071ed56d
SHA512 e215a2f8f8e99fc0d9de637f537fbc128a6aa3b9fbfe6ac89698727c0ea361be6c36423c57ebee41f765f085e91dc77853024822e2b2b14ddf6e9fea52b69a78
SSDEEP 3145728:cwiVhiDQbm1nGp/EHv/dNTyEYTsrBeLDQt1L6NSkR88i:cfhoQbm1nKsnSEYoBeLstsQkO5
TLSH
T1F7583343E2A3A0E8C16FD1348662A733FA31B85955352E7E1BD4CB342F31E90566EF25
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5216

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptFinishHash BCryptGetProperty BCryptHashData BCryptOpenAlgorithmProvider

d3d11

D3D11CreateDevice

d3dcompiler_47

D3DCompile

dcomp

DCompositionCreateDevice

dwmapi

DwmEnableBlurBehindWindow DwmGetColorizationColor DwmIsCompositionEnabled DwmSetWindowAttribute

dxgi

CreateDXGIFactory

gdi32

CreateRectRgn CreateRoundRectRgn DeleteObject GetDeviceCaps

hid

HidD_FreePreparsedData HidD_GetAttributes HidD_GetHidGuid HidD_GetPreparsedData HidP_GetCaps

kernel32

AddDllDirectory CancelIoEx CloseHandle CompareStringOrdinal CreateEventA CreateEventW CreateFileW CreateHardLinkW CreateMutexW CreateSemaphoreA CreateWaitableTimerExW DeleteCriticalSection DeleteFileW DuplicateHandle EnterCriticalSection FileTimeToSystemTime FindResourceW FormatMessageA FreeLibrary GetACP GetCPInfo GetCommandLineW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetEnvironmentVariableW GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetLocaleInfoA GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOverlappedResult GetPrivateProfileIntW GetPrivateProfileStringW GetProcAddress GetProcessAffinityMask GetProcessTimes GetStartupInfoW GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadPriority GetThreadTimes GetTickCount GetTickCount64 GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalUnlock InitializeCriticalSection IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LoadResource LocalFree LockResource MoveFileExW MultiByteToWideChar OpenProcess OutputDebugStringA QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseMutex ReleaseSemaphore RemoveDirectoryW RemoveDllDirectory ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetDefaultDllDirectories SetEndOfFile SetEvent SetFileInformationByHandle SetFilePointer SetFilePointerEx SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SetWaitableTimer SizeofResource Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VerSetConditionMask VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteFile WritePrivateProfileStringW

msvcrt

_XcptFilter ___lc_codepage_func ___mb_cur_max_func __iob_func __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _assert _beginthreadex _cexit _close _commode _endthreadex _errno _exit _fdopen _fileno _findclose _fmode _fstat64 _get_osfhandle _initterm _lock _lseeki64 _lseeki64 _read _set_error_mode _setjmp _strdup _strtoi64 _strtoui64 _telli64 _unlock _vscprintf _vsnprintf _wchdir _wchmod _wcmdln _wfindfirst _wfindnext _wfopen atexit _wfullpath _wgetcwd _wmkdir _wopen _write _wstat64 _wtoi _wutime64 abort atof calloc ceil exit exp fclose fflush fopen fprintf fputc fputs fread free fseek ftell fwrite getenv isalnum isdigit isspace getc iswctype isxdigit ldexp localeconv longjmp malloc memchr memcmp memcpy memmove memset qsort realloc setlocale setvbuf strchr strcmp strcoll strerror strftime strlen strncmp strncpy strtol strtoul strxfrm tolower vfprintf towlower towupper ungetc wcscat wcscmp wcscoll wcscpy wcsftime wcslen wcsxfrm

ole32

CoCreateInstance CoInitializeEx CoUninitialize

setupapi

CM_Get_DevNode_Registry_PropertyW CM_Get_Parent CM_Locate_DevNodeW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW SetupDiGetDeviceInterfaceDetailW

shell32

CommandLineToArgvW ShellExecuteW

user32

ClientToScreen CloseClipboard CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW EmptyClipboard EnumWindows FindWindowW GetAsyncKeyState GetCapture GetClassInfoExW GetClassNameW GetClientRect GetClipboardData GetCursorPos GetDC GetDpiForSystem GetDpiForWindow GetForegroundWindow GetKeyNameTextA GetKeyState GetKeyboardLayout GetLayeredWindowAttributes GetMessageExtraInfo GetMessageW GetMonitorInfoW GetRawInputData GetRawInputDeviceInfoW GetWindowDisplayAffinity GetWindowLongPtrW GetWindowRect GetWindowThreadProcessId IsIconic IsWindowUnicode IsWindowVisible LoadCursorW LoadIconW MapVirtualKeyA MapVirtualKeyW MessageBoxW MonitorFromPoint MonitorFromWindow OpenClipboard PeekMessageW PostMessageW PostQuitMessage PostThreadMessageW RegisterClassExW RegisterRawInputDevices ReleaseCapture ReleaseDC ScreenToClient SendMessageW SetCapture SetClipboardData SetCursor SetCursorPos SetLayeredWindowAttributes SetProcessDPIAware SetProcessDpiAwarenessContext SetWindowDisplayAffinity SetWindowLongPtrW SetWindowPos SetWindowRgn ShowWindow TrackMouseEvent TranslateMessage UnregisterClassW

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

288KB

Virtual Size

287KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

119KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

120.3MB

Virtual Size

120.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

Errors

General

Malware Config

Signatures

File Explorer

b0aware.exe

bcrypt

d3d11

d3dcompiler_47

dcomp

dwmapi

dxgi

gdi32

hid

kernel32

msvcrt

ole32

setupapi

shell32

user32

generic