Habit_Blink[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Habit_Blink.exe
Size 273KB
Sample220507-erdq9abcd3
SHA256 754baa6b4007335878ec474d4347f7a8bb42a9955324e84365f8c98c0d376617
MD5 df46f7077499c629fda43a178a70d6a0
SHA1 2ca2357a93f2343d64203a5649fd9f8b00702895
SHA512 ace0b255f2153897c36ab4ca772d471cec1904a20f14a05617254f9245bf01d4e592484624d32b588c3e91d2202cc8641e74a8482635567a53616fc484a9d0c5
SSDEEP 6144:TO9EMhhQ1rAc4wdi890rljSktzx4Fm7Lcl1nbQOa1:MEMhh6rAc4wdERj9tzT7Lc/b
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

Habit_Blink.exe

.exe 273KB

Habit_Blink.exe

IMPHASH 1b97638c44e28dc7f804031b638182b1
SHA256 754baa6b4007335878ec474d4347f7a8bb42a9955324e84365f8c98c0d376617
MD5 df46f7077499c629fda43a178a70d6a0
SHA1 2ca2357a93f2343d64203a5649fd9f8b00702895
SHA512 ace0b255f2153897c36ab4ca772d471cec1904a20f14a05617254f9245bf01d4e592484624d32b588c3e91d2202cc8641e74a8482635567a53616fc484a9d0c5
SSDEEP 6144:TO9EMhhQ1rAc4wdi890rljSktzx4Fm7Lcl1nbQOa1:MEMhh6rAc4wdERj9tzT7Lc/b
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

208642

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle GetLastError CreateMutexA lstrlenA lstrcmpA DeleteFileA GetPrivateProfileStringA IsProcessorFeaturePresent GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId QueryPerformanceCounter DecodePointer IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess EncodePointer GetStartupInfoW HeapSetInformation InterlockedCompareExchange GetPrivateProfileIntA lstrcpyA GetTempPathA GetLocalTime MultiByteToWideChar lstrcatA InterlockedExchange ExpandEnvironmentStringsA LoadLibraryA GetProcAddress FreeLibrary GetStdHandle GetFileType WaitForMultipleObjects PeekNamedPipe ReadFile FormatMessageA WaitForSingleObject VerSetConditionMask VerifyVersionInfoA SleepEx GetTickCount SetLastError EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection Sleep

user32

CreateWindowExA EndDialog PostQuitMessage KillTimer FlashWindow EndPaint BeginPaint DefWindowProcA DestroyWindow DialogBoxParamA wsprintfA LoadStringA LoadAcceleratorsA GetMessageA TranslateAcceleratorA TranslateMessage DispatchMessageA UpdateWindow LoadCursorA RegisterClassExA LoadIconA SetTimer ShowWindow

advapi32

CryptDestroyKey RegSetValueExA RegQueryValueExA RegCloseKey RegCreateKeyA RegOpenKeyExA CryptEncrypt CryptReleaseContext CryptImportKey CryptAcquireContextA CryptDestroyHash CryptGetHashParam CryptHashData CryptCreateHash

shell32

ShellExecuteA SHGetPathFromIDListA SHGetSpecialFolderLocation SHGetSpecialFolderPathA

ole32

CoUninitialize CoTaskMemFree CoCreateInstance CoInitialize

urlmon

URLDownloadToFileA

wininet

DeleteUrlCacheEntry

ws2_32

ntohs gethostname ioctlsocket listen accept recvfrom WSACleanup WSAStartup __WSAFDIsSet WSAGetLastError select recv send WSAIoctl setsockopt getsockname WSASetLastError bind htons getsockopt getpeername closesocket socket connect freeaddrinfo getaddrinfo sendto

wldap32

ord41 ord27 ord301 ord33 ord79 ord35 ord46 ord200 ord30 ord60 ord143 ord211 ord32 ord50 ord22 ord26

msvcr100

_controlfp_s _invoke_watson _except_handler4_common _onexit _lock __dllonexit _unlock ?_type_info_dtor_internal_method@type_info@@QAEXXZ ?terminate@@YAXXZ _crt_debugger_hook __set_app_type _fmode _commode __setusermatherr _configthreadlocale _initterm_e _initterm _acmdln exit _ismbblead _XcptFilter _exit _cexit __getmainargs _amsg_exit _strnicmp _stricmp _write _read _open _close _strdup isgraph isprint islower _stat64 ??0exception@std@@QAE@ABQBD@Z ??1exception@std@@UAE@XZ ??3@YAXPAX@Z memmove ??0exception@std@@QAE@ABV01@@Z ??2@YAPAXI@Z sprintf ?what@exception@std@@UBEPBDXZ _CxxThrowException calloc realloc free malloc memset _errno _time64 tolower sscanf fwrite fread __iob_func strchr strncpy memcpy strtol strrchr isalpha strncmp isxdigit strstr strtoul strpbrk _strtoi64 qsort fclose fputs fopen fgets isdigit fputc _beginthreadex strerror __sys_nerr isalnum isspace _getpid memchr _fstat64 _lseeki64 atoi getenv fflush fseek _gmtime64 isupper toupper __CxxFrameHandler3