blister | t | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

t
Size

1.4MB
MD5

ef1c9fd4357f22a922267e2878c74308
SHA1

709e0ba77048351101b9805e73c2ddeb44977761
SHA256

d12476c8b0f6a83b1662c2e736ad336f8e7550a6287bdcad94b772f1101d10c8
SHA512

89301dfe1b95d08b2d88d6baade62c99e8a46e54a1413339e672bf3cea4bcc2d3677c490c3650ffb0c74436ca184bab8abd3d32ebe91cf1d40b27fff065eee98
SSDEEP

24576:+0SwWQ+YAjPhvGGzab8U7P/rLj9+Q4SVg3iWPGQy0pjoEn0MNW7GZb0Lj5:9sP8b8U7P/HjMGVP2UahNWs0n5

Score

10^/10

loader blister

Malware Config

Signatures

Blister family
blister
Detect Blister loader x64 1 IoCs
loader

Processes:

resource yara_rule

sample family_blister_x64

resource	yara_rule
sample	family_blister_x64

Files

t
.dll windows x64

39cee923e9f552e976b6bd008831adf7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

fseek
fclose
clearerr
strtod
_errno
strtol
setlocale
strtoul
_HUGE
isxdigit
fflush
ftell
_fileno
fwrite
_finite
_XcptFilter
_initterm
_amsg_exit
__C_specific_handler
ferror
fread
fopen
fsetpos
fgetpos
setbuf
sscanf
remove
exit
realloc
_vsnprintf
fprintf
malloc
calloc
memmove
time
strstr
strncmp
gmtime
getenv
_iob
strtok
_chsize
free
memset
memcpy
floor

kernel32

RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
Sleep
TlsFree
TlsAlloc
DeleteCriticalSection
LoadLibraryA
EnterCriticalSection
GetProcAddress
LeaveCriticalSection
InitializeCriticalSection
TlsSetValue
TlsGetValue
RtlCaptureContext

Exports

Exports

__glsParser_create
__glsParser_print
__glsString_appendChar
__glsString_assign
__glsString_init
glsAbortCall
glsAppRef
glsBeginCapture
glsBeginGLS
glsBeginObj
glsBinary
glsBlock
glsCallArray
glsCallArrayInContext
glsCallStream
glsCaptureFlags
glsCaptureFunc
glsChannel
glsCharubz
glsCommandAPI
glsCommandFunc
glsCommandString
glsComment
glsContext
glsCopyStream
glsDataPointer
glsDeleteContext
glsDeleteReadPrefix
glsDeleteStream
glsDisplayMapfv
glsEndCapture
glsEndGLS
glsEndObj
glsEnumString
glsError
glsFlush
glsGLRC
glsGLRCLayer
glsGenContext
glsGetAllContexts
glsGetCaptureDispatchTable
glsGetCaptureExecTable
glsGetCaptureFlags
glsGetCommandAlignment
glsGetCommandAttrib
glsGetCommandFunc
glsGetConsti
glsGetConstiv
glsGetConstubz
glsGetContextFunc
glsGetContextListl
glsGetContextListubz
glsGetContextPointer
glsGetContexti
glsGetContextubz
glsGetCurrentContext
glsGetCurrentTime
glsGetError
glsGetGLRCi
glsGetHeaderf
glsGetHeaderfv
glsGetHeaderi
glsGetHeaderiv
glsGetHeaderubz
glsGetLayerf
glsGetLayeri
glsGetOpcodeCount
glsGetOpcodes
glsGetStreamAttrib
glsGetStreamCRC32
glsGetStreamReadName
glsGetStreamSize
glsGetStreamType
glsHeaderGLRCi
glsHeaderLayerf
glsHeaderLayeri
glsHeaderf
glsHeaderfv
glsHeaderi
glsHeaderiv
glsHeaderubz
glsIsContext
glsIsContextStream
glsIsExtensionSupported
glsIsUTF8String
glsLong
glsLongHigh
glsLongLow
glsNullCommandFunc
glsNumb
glsNumbv
glsNumd
glsNumdv
glsNumf
glsNumfv
glsNumi
glsNumiv
glsNuml
glsNumlv
glsNums
glsNumsv
glsNumub
glsNumubv
glsNumui
glsNumuiv
glsNumul
glsNumulv
glsNumus
glsNumusv
glsPad
glsPixelSetup
glsPixelSetupGen
glsReadFunc
glsReadPrefix
glsRequireExtension
glsSwapBuffers
glsUCS1toUTF8z
glsUCS2toUTF8z
glsUCS4toUTF8
glsUCS4toUTF8z
glsUCStoUTF8z
glsULong
glsULongHigh
glsULongLow
glsUTF8toUCS1z
glsUTF8toUCS2z
glsUTF8toUCS4
glsUTF8toUCS4z
glsUTF8toUCSz
glsUnreadFunc
glsUnsupportedCommand
glsUpdateCaptureExecTable
glsWriteFunc
glsWritePrefix

Sections

.text
Size: 403KB - Virtual size: 402KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

39cee923e9f552e976b6bd008831adf7

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

Exports

Exports

Sections

.text Size: 403KB - Virtual size: 402KB

.data Size: 8KB - Virtual size: 9KB

.pdata Size: 19KB - Virtual size: 19KB

.rsrc Size: 1.0MB - Virtual size: 1.0MB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 403KB - Virtual size: 402KB

.data
Size: 8KB - Virtual size: 9KB

.pdata
Size: 19KB - Virtual size: 19KB

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

.reloc
Size: 8KB - Virtual size: 8KB