blister | afb77617a4ca637614c429440c78da438e190dd1ca24dc78483aa731d80832c2

Resubmissions

07-07-2022 11:51

220707-n1m6qahha2 10

31-01-2022 06:31

220131-g95nssgge2 3

Sharing

Copy URL

Twitter E-mail

General

Target

afb77617a4ca637614c429440c78da438e190dd1ca24dc78483aa731d80832c2
Size

3.1MB
MD5

7a5324615cbf70bad37c84cefb012e80
SHA1

ebbac85d574144f92e23829bea472f3aa43100fa
SHA256

afb77617a4ca637614c429440c78da438e190dd1ca24dc78483aa731d80832c2
SHA512

2f715f203eae83c448e81c4cbd283638cf5c080dbb607c67a1545e417b4066c8fc23990409e500aa82c77630198d9069a7da45be90f055dd3f46c3be1a4ed2c1
SSDEEP

98304:/XPYUZXpIgzXztxNni4F1y2Xb7EwJ82JlFfpwHMX9duA:/Xw0CgzZri4Fw2XHV82ZfwuR

Score

10^/10

loader blister

Malware Config

Signatures

Blister family
blister
Detect Blister loader x32 1 IoCs
loader

Processes:

resource yara_rule

sample family_blister_x32

resource	yara_rule
sample	family_blister_x32

Files

afb77617a4ca637614c429440c78da438e190dd1ca24dc78483aa731d80832c2
.dll regsvr32 windows x86

819bafeed839d2c395e6015fe119e65b

Code Sign

01
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01-01-2004 00:00

Not After

31-12-2028 23:59

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2f:4a:25:d5:2b:16:eb:4c:9d:fe:71:eb:bd:81:21:bb
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

24-08-2021 00:00

Not After

24-08-2022 23:59

Subject

CN=Blist LLC,O=Blist LLC,ST=Tatarstan\, Respublika,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:be:85:1f:86:92:50:fc:0e:bc:f2:90:01:75:5e:f1:e0:b2:97:fe
Signer

Actual PE Digest

03:be:85:1f:86:92:50:fc:0e:bc:f2:90:01:75:5e:f1:e0:b2:97:fe

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Blist LLC,O=Blist LLC,ST=Tatarstan\, Respublika,C=RU

15-09-2021 23:33
Valid: true

Chain 1

CN=Blist LLC,O=Blist LLC,ST=Tatarstan\, Respublika,C=RU

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

free
memcpy_s
wcsncpy_s
??_U@YAPAXI@Z
memset
??3@YAXPAX@Z
_wcsicmp
_vsnwprintf
_ltow_s
??2@YAPAXI@Z
??_V@YAXPAX@Z
_purecall
malloc
_onexit
_lock
__dllonexit
_unlock
_errno
realloc
_except_handler4_common
_amsg_exit
_initterm
_XcptFilter

kernel32

RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
DisableThreadLibraryCalls
LocalFree
CloseHandle
ReleaseMutex
WaitForSingleObject
GetLastError
CreateMutexW
GetCommandLineW
lstrlenW
InterlockedIncrement
InterlockedDecrement
LoadLibraryW
GetModuleHandleW
lstrcmpiW
FreeLibrary
MultiByteToWideChar
SizeofResource
DeactivateActCtx
FindResourceW
LoadLibraryExW
GetModuleFileNameW
SetFileAttributesW
GetFileAttributesW
lstrcmpW
GetCurrentProcessId
SetLastError
FormatMessageW
GetDateFormatW
GetCurrentProcess
GetVersionExA
InterlockedExchange
Sleep
InterlockedCompareExchange
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
OutputDebugStringA
CreateActCtxW
ReleaseActCtx
LoadResource
ActivateActCtx
GetProcAddress

shell32

ShellExecuteW
CommandLineToArgvW
ShellExecuteExW
ord258
SHGetDesktopFolder

winspool.drv

EnumPrintersW
OpenPrinterW
ClosePrinter

user32

TrackPopupMenuEx
RemoveMenu
GetSubMenu
GetWindowRect
EnableWindow
SendMessageW
GetMonitorInfoW
EnumDisplayMonitors
GetParent
SetWindowTextW
EnumDisplayDevicesW
SetFocus
GetSystemMetrics
PostMessageW
RegisterClipboardFormatW
EndDialog
PostQuitMessage
UnregisterClassA
CharPrevW
LoadCursorW
RegisterClassW
UpdateWindow
SetTimer
DestroyWindow
GetWindowTextW
GetClientRect
BeginPaint
EndPaint
GetDC
SetWindowRgn
ReleaseDC
DefWindowProcW
LoadMenuW
LoadIconW
GetWindowLongW
SetWindowLongW
GetDlgItem
GetWindowPlacement
SetWindowPlacement
ShowWindow
SetDlgItemTextW
ChangeWindowMessageFilterEx
OpenIcon
SetForegroundWindow
SetWindowPos
CallWindowProcW
CharNextW
RegisterWindowMessageW
FindWindowW
GetWindowThreadProcessId
AllowSetForegroundWindow
SendMessageTimeoutW
CreateWindowExW
DialogBoxParamW
LoadStringW
RedrawWindow

ole32

HWND_UserFree
HWND_UserUnmarshal
HWND_UserMarshal
HWND_UserSize
CoInitializeEx
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoGetObject
StringFromGUID2
ReleaseStgMedium
CoUninitialize

gdi32

PatBlt
SelectObject
GetTextExtentPointW
SetTextColor
CreateFontIndirectW
PathToRegion
StrokePath
DeleteObject
CreatePen
EndPath
TextOutW
SetBkMode
BeginPath

advapi32

RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
GetTokenInformation
GetFileSecurityW
OpenProcessToken
DuplicateToken
AccessCheck
RegQueryValueExW
RegCloseKey
RegDeleteValueW
RegCreateKeyExW
RegOpenKeyExW

shlwapi

StrRetToStrW
PathFindFileNameW

mscms

InternalRefreshCalibration
InternalGetDeviceConfig
WcsGetUsePerUserProfiles
ColorCplSetUsePerUserProfiles
WcsGetDefaultColorProfile
ColorCplHasSystemWideAssociationListChanged
ColorCplResetSystemWideAssociationListChangedWarning
ColorCplMergeAssociationLists
ColorCplOverwritePerUserAssociationList
ColorCplSaveAssociationList
ColorCplGetDefaultProfileScope
ColorCplGetDefaultRenderingIntentScope
ColorCplReleaseProfileProperties
WcsGetCalibrationManagementState
GetColorDirectoryW
WcsEnumColorProfilesSize
WcsEnumColorProfiles
InstallColorProfileW
UninstallColorProfileW
InternalWcsAssociateColorProfileWithDevice
WcsDisassociateColorProfileFromDevice
WcsSetDefaultColorProfile
WcsSetDefaultRenderingIntent
InternalSetDeviceConfig
ColorCplLoadAssociationList
WcsSetCalibrationManagementState
ColorCplUninitialize
WcsGetDefaultRenderingIntent
WcsGpCanInstallOrUninstallProfiles
ColorCplGetProfileProperties
ColorCplInitialize

oleaut32

SysStringLen
SysAllocString
VarUI4FromStr
SysFreeString

rpcrt4

IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
NdrOleFree
CStdStubBuffer_QueryInterface
NdrOleAllocate
CStdStubBuffer_AddRef
CStdStubBuffer_Connect
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_CountRefs
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
NdrDllRegisterProxy
NdrDllUnregisterProxy
IUnknown_Release_Proxy
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease

setupapi

SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
SetupDiGetDevicePropertyW

ntdll

WinSqmAddToStream

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
LaunchColorCpl

Sections

.orpc
Size: 512B - Virtual size: 51B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

819bafeed839d2c395e6015fe119e65b

Code Sign

01Certificate

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

2f:4a:25:d5:2b:16:eb:4c:9d:fe:71:eb:bd:81:21:bbCertificate

Extended Key Usages

Key Usages

03:be:85:1f:86:92:50:fc:0e:bc:f2:90:01:75:5e:f1:e0:b2:97:feSigner

Signature Validations

Verification

15-09-2021 23:33 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

shell32

winspool.drv

user32

ole32

gdi32

advapi32

shlwapi

mscms

oleaut32

rpcrt4

setupapi

ntdll

Exports

Exports

Sections

.orpc Size: 512B - Virtual size: 51B

.text Size: 64KB - Virtual size: 63KB

.data Size: 1024B - Virtual size: 2KB

.rsrc Size: 3.0MB - Virtual size: 3.0MB

.reloc Size: 6KB - Virtual size: 5KB

01
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

2f:4a:25:d5:2b:16:eb:4c:9d:fe:71:eb:bd:81:21:bb
Certificate

03:be:85:1f:86:92:50:fc:0e:bc:f2:90:01:75:5e:f1:e0:b2:97:fe
Signer

15-09-2021 23:33
Valid: true

.orpc
Size: 512B - Virtual size: 51B

.text
Size: 64KB - Virtual size: 63KB

.data
Size: 1024B - Virtual size: 2KB

.rsrc
Size: 3.0MB - Virtual size: 3.0MB

.reloc
Size: 6KB - Virtual size: 5KB