`zh��\�J,���bU���@I!�#�/d��tcF����*$�9#nj@�0LR:;T��r#����/5ɪ-l���=�K�M2���ϫu�u��0�#:}=<"��R|�8ۅe+��� �~J��+� �K�jB��#�_�EK�+`��a��᛫=��W���H��Vi��4;��������;�9����۠��@ o(ff0ݧ7T���/�4J�t�k%I���6a�ΎH��6QTJ2���{]���%̱�Pk�mc� G:OZ�V�i'�^/;s��ʼn��2��|�˯~AX� �f�M����O��Eru��^gp�F��Wkq��MT�أ�?�ˇ���Y�ԻA��T�^��mif4�"��d?��y�~��&�لT���OG3��=9�Q-!Eh�^%*(��25��q�'�=W�'���s�����g�u���Xm�F ��xV*���.����m�Ξ����P��z2�#*��ȟ�dzR����O����loM�{R�]aV�B���)o}E]��������R��^��7�t���S�R#��m�IF��^�)pNs�G8��^W�'�s �pd�ը�k�\�DD�--c7A\�j��`H�)Y@>D7�\�q�Q� ��6����j�>����R�4��"7���hKsNs-M_r�T�ٗ��"H�V���l���z�ct� ��c9K�(�=��������]z�;���T0t�i.#�9`������yz��m��R��D�A�\��$���OD��6:�S�a�������?�Vx����ʺp���H�"� ��Ȁ3��Iu���D�q��; Ѩ��1�����a�!�6M����ÝZA�C�'h>�>�5ջ_<����w�k��/����a�߷��J�-�8�>�_�KU��>�a�BX:�*:�cx/�h����J��_;��r)�����^����r�BH�$[u��'��,m���A*�ۢ��Vs;�C?H8z�E��grAA��&���}��V�ؾ//�$��u5���i�f��[=Y��I�0��]�^6�n�$�}♨aO��}�xSr=}���5��th�;�$��6� ��0R���e���|?$��$��y��15J_����L�5s�\m��5t<��7�.�*O����X4�,4H2�B��H��bA�vU%��A����=�.?q��딅���]�#GR�[� ���졽F�[ �+��b%W��1^C�n���&��i[Dh\� w�=fTH������c^�y������(i�H�XX���6��OQv��� 2���-�G:4� �X����:+S�GEiW$��bs�bZ7��}����E4]�Y��pt�,���Cs%��x���2[���?ҫD���-�9�d�֕6���>c�s�=o1U���f�|c��U>�JIH�u��q���%���?JҞ�1<� �=q]Rt�!��o[�QH��J�WH���@�X<rػ���M��!�n�s(�f�?iƩn�~Y&#B.6=Wx�Ȝf��kH�;2N1~��X]�A��'�(}�d��������K�e�Ă�o~C�'#���.�qhp�W�30)_��K8�c�N��I�U�؉�s���%o0X��>��G$�����BjJ�o�R���W�k��ң��"ބ����Ř�@�G?�7X�[T�����Us���^6'�H�H������!����b2�J�^�aF�:�>~���[���rU���AL���,�}�v��嚭�7�c]UuC8NI�!�@Kk93�#��Pn%.`�qkF���/�����%�������T��z��y�5�#��F3�-����?���m�cM\�S z� ���z� �@�7GU � ���ֳ��\s�K��n�tBB���r�/fɠ �^�ˌ����q�i³ ��epNqW��MJ]���v&~NJs�{cs��YA7��ї�����y�]7z�в�U1 <4�^����_ �����V��:��P$3�w��c���=�6�Kr���.&A����Ct�a}��\@zn "��!�w�㦕�e���NG����nNU -:����e�.�C�A���V�/e<��4(�X��[��+`�7��-��W(g�haT�N��f����|8��Ck�#X�J:L���v�lq�1& �m���Onk�+�����-�ɣ6߯Eo]X�6���1��Jf���u<BُDz��!c&�����<��.�K��Np����52,pVT��%���3nQT�;�p�aj�:��Ѹx�%9�Y�W��]���Y���./j���z�6N�&��h�.��03�]s�-�XӰIa�1�!����C�23Y��u7`�9�`ʼ&���m&A �^fږN�nB� �tgC��?��+`L�`�_���3j��-x�P���'��t�U,��S<S��M!���B�_����EC������!�1�y�=�ݷ�L���l�����'�l��$O����)��Z�$~ �4ӎ�N+�%�#�,�5�����+M/���Ĩ�YN%�2�$�u�m,SN��E��d������k�-������DOZ���m�K>P�`x$%4C̀8�_���e�bG�G;���a�8����O��3X����a��0���D1(*�-:6g�����E&�kX���p�Zَ ��6��؞魱-��V���Ꮮ}}��CHn�D]�w�Mn�~ 5�9��=��4��ԩ�!�_����; �b���v�nwyzt�'AKqe�.�~if< j�X[�<�n b\���c�C*:�nG�d%�0�w��>��dЊ����6[P�Fa�{ Xq �%���3���܂q� �F@L��7��4��$�1�hqbq����B�>E�,h�D(G�����6�oR�x���fz��� G*��M�d��^� ��f:j���j�X���l��D��C�M����\�%�y�`cb��A�cz�|w��P�W�$�}�qr��r0��KV��A#ld��z)]�Xs�X{⬻�.�3����8/m鴶����$ N�B��w�,��qj��}{���씗����O�Ĵ��N����Zx�{Z�1)
Static task
static1
General
-
Target
Blueberry_Swoofer_Release_1.2.exe
-
Size
6.9MB
-
MD5
9e0c5a5553135e3f7abc9c050b50945e
-
SHA1
0ce2e955b6e044c754cfead80e9906da857ba896
-
SHA256
15061d679acac3e90266985e54974e4b8a8631ef74193339a0c43792f19e41a5
-
SHA512
72efb51766ed8fb8f2f80f5f0b1649c378c7bdf22c56ffc0a46428110515f4d7d894859df634d053ab39c3c739b078e1ad25598ca443b2aa23db1162a22f56a8
-
SSDEEP
196608:yQA84YnjobMs4EnySEy1I0/B3iVSEiuIfu:O8pjErnyUN/RiVSEJ
Malware Config
Signatures
Files
-
Blueberry_Swoofer_Release_1.2.exe.exe windows x64
074686dee026508fa0d255506ae42611
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
ReadFile
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetKeyState
CharUpperBuffW
gdi32
GetDeviceCaps
advapi32
CryptImportKey
imm32
ImmReleaseContext
msvcp140
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
ntdll
RtlLookupFunctionEntry
d3d9
Direct3DCreate9
normaliz
IdnToAscii
wldap32
ord143
crypt32
CertEnumCertificatesInStore
ws2_32
ntohl
rpcrt4
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_copy
api-ms-win-crt-stdio-l1-1-0
_pclose
api-ms-win-crt-string-l1-1-0
strcspn
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
__setusermatherr
shell32
ShellExecuteA
Exports
Exports
Sections
.text Size: - Virtual size: 856KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 191KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VD} Size: - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.>*] Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Y& Size: 6.9MB - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ