BlazingPackLauncher[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

BlazingPackLauncher.exe
Size

33.9MB
MD5

62ac4d11d83ee04f4d60153964fff3ec
SHA1

f5f11db822d4b6d5c4ed359d81b11b80b88e088e
SHA256

bee636c1a9f66db57e21058801189f5cf878fccd0cd341ce688e53b2f4de78f3
SHA512

ab456739f241c68a6e3c2ded753247c4f57c1bcab9e9394d35ffec3f30d3755bea6fded8af583505e168f30520a34a9f6a185315a44d59cd8bb16270b94aaf2a
SSDEEP

393216:jo8+w83N+UEAfgDsmim34RQBRq+0okBueFgjecfKHt7ndjEC1dpzYljdzb5GJNXP:gVlFkdr8sne7ww1S6U2mJXCVL/Z

Score

1^/10

Malware Config

Signatures

Files

BlazingPackLauncher.exe
.exe windows x86

0310f833ecfed3fb31b1f1a28a452ad0

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e1:98:15:a9:c8:f5:60:cd:38:82:cc:23:e9:c6:58:49
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

10/01/2022, 00:00

Not After

10/01/2023, 23:59

Subject

CN=BlazingSoft SP. Z O. O.,O=BlazingSoft SP. Z O. O.,ST=Wielkopolskie,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

d3:53:2a:b6:ea:f9:81:4f:dc:ed:bf:53:2d:b7:6b:de:be:d1:ea:21:00:bd:8c:99:1c:0d:1a:d0:73:b8:39:3c
Signer

Actual PE Digest

d3:53:2a:b6:ea:f9:81:4f:dc:ed:bf:53:2d:b7:6b:de:be:d1:ea:21:00:bd:8c:99:1c:0d:1a:d0:73:b8:39:3c

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=BlazingSoft SP. Z O. O.,O=BlazingSoft SP. Z O. O.,ST=Wielkopolskie,C=PL

09/03/2023, 19:03
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtCancelIoFileEx
RtlGetNtVersionNumbers
NtQuerySystemInformation
RtlNtStatusToDosError
NtDeviceIoControlFile
NtCreateFile
RtlUnwind
RtlCaptureContext

secur32

DecryptMessage
ApplyControlToken
InitializeSecurityContextW
AcceptSecurityContext
EncryptMessage
DeleteSecurityContext
QueryContextAttributesW
FreeCredentialsHandle
AcquireCredentialsHandleA
FreeContextBuffer

kernel32

TlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
ResetEvent
IsProcessorFeaturePresent
UnhandledExceptionFilter
EncodePointer
SetUnhandledExceptionFilter
InitializeSListHead
IsDebuggerPresent
RaiseException
WriteConsoleW
GetConsoleMode
GetTempPathW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetCurrentThreadId
CloseHandle
GetModuleHandleW
ReleaseMutex
ReleaseSRWLockShared
AcquireSRWLockShared
CreateMutexW
GetLastError
GetComputerNameExW
TryAcquireSRWLockExclusive
TlsGetValue
TlsSetValue
GetCurrentProcess
GetCurrentThread
GetProcAddress
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetTickCount64
GlobalMemoryStatusEx
GetLogicalDrives
GetDiskFreeSpaceExW
GetExitCodeProcess
GetCurrentProcessId
GetSystemInfo
CreateFileW
OpenProcess
GetProcessTimes
GetSystemTimes
GetProcessIoCounters
RegisterWaitForSingleObject
GetDriveTypeW
GetVolumeInformationW
DeviceIoControl
SleepConditionVariableSRW
LoadLibraryExW
FreeLibrary
lstrlenW
GetModuleHandleA
GetUserDefaultUILanguage
LCIDToLocaleName
LoadLibraryW
GlobalLock
GlobalUnlock
GlobalAlloc
GetFileAttributesW
GetModuleFileNameW
OutputDebugStringA
OutputDebugStringW
GetEnvironmentVariableW
SetFileTime
GetProcessHeap
HeapAlloc
HeapFree
FormatMessageW
SetEvent
WaitForSingleObject
CreatePipe
DuplicateHandle
GetFileInformationByHandle
SetFileAttributesW
MoveFileExW
SetFileInformationByHandle
SetLastError
GetFinalPathNameByHandleW
GetSystemTimeAsFileTime
QueryPerformanceCounter
QueryPerformanceFrequency
UnregisterWaitEx
SetHandleInformation
CreateIoCompletionPort
SetFileCompletionNotificationModes
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
ReadFile
GetOverlappedResult
Sleep
FreeEnvironmentStringsW
FindClose
CompareStringOrdinal
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
GetCurrentDirectoryW
GetEnvironmentStringsW
SetEnvironmentVariableW
GetCommandLineW
SetFilePointerEx
CreateDirectoryW
GetStdHandle
WriteFileEx
SleepEx
ReadFileEx
TerminateProcess
GetProcessId
WaitForMultipleObjects
WakeAllConditionVariable
WakeConditionVariable
TlsAlloc
HeapReAlloc
FindNextFileW
GetFileInformationByHandleEx
FindFirstFileW
DeleteFileW
RemoveDirectoryW
CreateSymbolicLinkW
CreateHardLinkW
CopyFileExW
CreateEventW
CancelIo
ExitProcess
GetFullPathNameW
CreateNamedPipeW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
CreateThread

user32

MapVirtualKeyW
GetMessageW
GetAncestor
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
PostThreadMessageW
RedrawWindow
FlashWindowEx
ChangeDisplaySettingsExW
PeekMessageW
EnableMenuItem
SetWindowPlacement
GetWindowPlacement
LoadCursorW
IsWindowVisible
SetCursor
AdjustWindowRectEx
CreateIcon
ValidateRect
GetUpdateRect
RegisterHotKey
TrackMouseEvent
SystemParametersInfoA
GetKeyboardLayout
DestroyIcon
PostMessageW
ShowCursor
InvalidateRgn
ClipCursor
SetWindowPos
GetClipCursor
CheckMenuItem
ShowWindow
GetWindowLongW
GetWindowRect
SendInput
SetWindowTextW
GetClientRect
GetRawInputData
MonitorFromPoint
EnumDisplayMonitors
IsProcessDPIAware
GetDC
CreateAcceleratorTableW
DestroyAcceleratorTable
GetMenu
TrackPopupMenu
SetForegroundWindow
RegisterTouchWindow
GetSystemMetrics
VkKeyScanW
MapVirtualKeyExW
GetAsyncKeyState
GetKeyboardState
UnregisterHotKey
SetCapture
MsgWaitForMultipleObjectsEx
RegisterRawInputDevices
SetMenuItemInfoW
IsWindow
EnumChildWindows
DestroyWindow
CreateMenu
DefWindowProcW
CreateWindowExW
CreatePopupMenu
AppendMenuW
PostQuitMessage
ToUnicodeEx
OpenClipboard
GetClipboardData
CloseClipboard
EmptyClipboard
RegisterClipboardFormatW
SetClipboardData
RegisterWindowMessageA
GetMessageA
DispatchMessageA
MessageBoxW
RegisterClassExW
MonitorFromRect
SetWindowLongW
RegisterClassW
GetForegroundWindow
GetActiveWindow
SetCursorPos
ReleaseCapture
SetMenu
SendMessageW
FindWindowW
GetMonitorInfoW
MonitorFromWindow
GetCursorPos
CloseTouchInputHandle
ScreenToClient
GetTouchInputInfo
ClientToScreen
GetKeyState

ws2_32

getaddrinfo
freeaddrinfo
WSACleanup
WSAStartup
WSAGetLastError
WSAIoctl
setsockopt
send
WSASend
recv
shutdown
getsockopt
listen
ioctlsocket
connect
bind
WSASocketW
getpeername
getsockname
accept
closesocket

gdi32

GetDeviceCaps
CreateRectRgn
DeleteObject

dwmapi

DwmEnableBlurBehindWindow

ole32

RegisterDragDrop
RevokeDragDrop
CreateStreamOnHGlobal
CoTaskMemFree
OleInitialize
CoSetProxyBlanket
CoUninitialize
CoTaskMemAlloc
CoInitializeEx
CoInitializeSecurity
CoCreateInstance

comctl32

DefSubclassProc
RemoveWindowSubclass
SetWindowSubclass

pdh

PdhGetFormattedCounterValue
PdhRemoveCounter
PdhCollectQueryData
PdhCloseQuery
PdhAddEnglishCounterW
PdhOpenQueryA

advapi32

RegCloseKey
EventUnregister
EventWriteTransfer
EventSetInformation
EventRegister
RegOpenKeyExW
SystemFunction036
RegGetValueW
RegQueryValueExW

oleaut32

GetErrorInfo
VariantClear
SysAllocString
SysFreeString
SysStringLen
SetErrorInfo

iphlpapi

GetIfTable2
FreeMibTable
GetIfEntry2

powrprof

CallNtPowerInformation

netapi32

NetUserGetLocalGroups
NetQueryDisplayInformation
NetApiBufferFree

shell32

DragQueryFileW
ShellExecuteW
Shell_NotifyIconGetRect
DragFinish
SHCreateItemFromParsingName
Shell_NotifyIconW
SHGetKnownFolderPath

uxtheme

SetWindowTheme

crypt32

CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertCloseStore
CertFreeCertificateContext
CertDuplicateStore
CertOpenStore
CertDuplicateCertificateChain
CertFreeCertificateChain
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertAddCertificateContextToStore

bcrypt

BCryptGenRandom
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider

psapi

EnumProcessModulesEx
GetModuleFileNameExW
GetPerformanceInfo

api-ms-win-crt-string-l1-1-0

wcsncmp
strlen
wcslen
strcpy_s
_wcsicmp

api-ms-win-crt-math-l1-1-0

sin
ceil
trunc
round
exp
floor
pow
truncf
roundf
exp2f
__setusermatherr

api-ms-win-crt-convert-l1-1-0

wcstol
_ultow_s

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
free
_set_new_mode
calloc

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_set_app_type
_seh_filter_exe
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
_configure_narrow_argv
abort
terminate
_controlfp_s
__p___argc
__p___argv
_cexit
_c_exit
_crt_atexit
_initialize_onexit_table
_register_onexit_function
_register_thread_local_exe_atexit_callback

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 12.4MB - Virtual size: 12.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20.7MB - Virtual size: 20.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 271KB - Virtual size: 271KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 443KB - Virtual size: 443KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0310f833ecfed3fb31b1f1a28a452ad0

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

e1:98:15:a9:c8:f5:60:cd:38:82:cc:23:e9:c6:58:49Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

d3:53:2a:b6:ea:f9:81:4f:dc:ed:bf:53:2d:b7:6b:de:be:d1:ea:21:00:bd:8c:99:1c:0d:1a:d0:73:b8:39:3cSigner

Signature Validations

Verification

09/03/2023, 19:03 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

secur32

kernel32

user32

ws2_32

gdi32

dwmapi

ole32

comctl32

pdh

advapi32

oleaut32

iphlpapi

powrprof

netapi32

shell32

uxtheme

crypt32

bcrypt

psapi

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 12.4MB - Virtual size: 12.4MB

.rdata Size: 20.7MB - Virtual size: 20.7MB

.data Size: 15KB - Virtual size: 18KB

.rsrc Size: 271KB - Virtual size: 271KB

.reloc Size: 443KB - Virtual size: 443KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

e1:98:15:a9:c8:f5:60:cd:38:82:cc:23:e9:c6:58:49
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

d3:53:2a:b6:ea:f9:81:4f:dc:ed:bf:53:2d:b7:6b:de:be:d1:ea:21:00:bd:8c:99:1c:0d:1a:d0:73:b8:39:3c
Signer

09/03/2023, 19:03
Valid: false

.text
Size: 12.4MB - Virtual size: 12.4MB

.rdata
Size: 20.7MB - Virtual size: 20.7MB

.data
Size: 15KB - Virtual size: 18KB

.rsrc
Size: 271KB - Virtual size: 271KB

.reloc
Size: 443KB - Virtual size: 443KB