�{ߠ��c������٣���Ǭ���w�yu4����j��2���7�]1��_�w�(e�p���R@���=1��N�K�D�b;6� ������ᑨx�@s����Ql���I�mUmR���{ՙ���'���kNZ�;1EYIM��M�:R� +���kE`��?��P�1���A������"�.#��J<Q<����#��2��c�8$��&���b6UT�/敨�.��v�9)�钊rZ@����JX�!u�������{���d�n���^F�g � �Ŝ��F6q:X!u�5:$�p?����W ����L] �L{v����>���� �7�ŶeK�5��Fq*���1� ��+�����r7�\�7]����� �m��8��92Y�*�����)\��Z��!k\�B�������)h�gPo����U ������DOVG�K9%0P�f�Zjb����`�dE:\�J�������ɉ0^��Q��>�9�L�&ڽ3��'��T�ş?��M}J��잳t��͇x�]l����V@� �Q��q"MX^@3mm���T�� ��a�YWw��;C�)40u ���H��j(��ꘚ�+�@�!"2��DH^��jH���\����{����S��MՆ�Z��I[�& �*f�DŽ�iPǙ��n�\H��ٓEz9 ��Ь2��b���@0!� 0���ʢ%��R|C��rX��\�]qɧ�^0E.������\�l�����r�:D�6�iP�E_�jɒ��m;�m��#�JC�Ny�Y|����.ʃ=]j�O6��\�o�a�C������ �3��)��Hhbu���� ����m ;��� e������e v_%���˓���y�7=E¦�\�ィ9����|ſ�E"Ǚ�t1�ݧ��աU�~����=#�J.+����Z�&���_��9��s���/E��+@�3�N�^^oO^`�e(�������uV�e߷�O��h������Uv��C��KO�D���6��nu�b$66�S��c$��W��q�4M$�p��kp��^�9�<�Vx��=��*�f��T�xइ#S pV�7*.c=Kcׄ�u�S���`'�[I&��GK0�% T��D����O��wq�o�����AHl%�̹��I�������e<�E>�H;o�t4) (5���˿o�E�lېe�!�z�m�7!ޜ��ץ_u�3�e^�O�~QC�+&���5��o�"(T�l;/�y^-_j:����J�(����͛�Gܒ�����Y��T"M����1�Dϥ��� ����`�ܦ��;-n[��C`�F&�a���$�y�)䐼~1�G%��c�f��1�$F,P�ԉ}1ģ��6KnB�P���@���R*��2n���� b'������'7�"d�T1Bjτ�2Jo��\�����E�)����ݚ��P?a���W~��-;Tq�K8�8:��N}_{a�&>h B�x�'��$�n5$dǘ�WP��éL�5�TsL��,�v�������q_�Y�"� B���cu����}��v�tE����m���~<<1TU�r�)69�P����k6����^.�z�8e�b��[a��T�B�M�>q�.y���$u`=^`�Pǃ�w�A��g�?w���UU���Efc_%�A[¨%�Lp6�Ѕ��o���6)���j&�&�~����nS�J�;� g{/��"e)���g�@ �.�CȮ���[� ءW��� ߁F�?�E�Ņ�(|���8+�*���t����J���@ӳ��S��X���<�9d�k�����]w5f�B��`����Z��Td��" ���r� �=^�c��sG ��1�9SE���g��]n�-�J�bgg`��q�U�ӭ#�]��eqO�қs����nRŋ���MoD" Ҽ&�穲�k,"���L����s "��4O��YҬ���.�,5c����j9RШ�7pn��E���0)x�)-k��6�"À������)������0:���fb(�l!�]B�ޯFŞ����������'7�(�)���5տ��A��{���r=�ǣ�E7�߾�_+[�����G��;C��P�"���P*;D�\�FJ�S�Om ��u& ���+�W*f�C�}n��E͜m���#��L���s�����XnGG��8�U~�̥���.���hb�S���y�� �[O݈{$C����kXb��Ί��c�1;��_�!��a� !�Rh>��-B�T~��eZ`��Ϯ��!�������`!�,�� T/6>��r�B�w>ڛ�u��V�LoR�B� ���.㎭%Wnz��c��W���*.n����|��p�������2� ���<+~Plo�øh9ĥD�v����kۄ�ս]�2M�ը{��4�F+��W�|k��3{U�<5�&9ڵ͘ 2���}���"L�\�L� ߏ�7���у�}�o�8�=������Mے�ӯ��� ��.��� �]<w�����Y���:��x����Q����J��)f֖����yӎF�z�\����?�����pKz�6�m5�U���TP�13���ÅTȦ��2���������B/p��͞[�K�tm�7�:�����@] �q� ���bwPܔp�K��[5���h\�7�tΕ��X�5Ƭ�p�x'�_�t����^��e�7�. ��l��k�7|�� �q���,��=<X��F�&��\����h�#҄�� I`�1������b4CAnG+\v���x䦤���o�dOq �z�pd�9�T+Nқ,(�NgHD؟��F0`#Į'��������\@7Z�ts�W�� ��]�Sy주�̢�Nv�~4�K݆�s��;S�A.�o��M�u���7 �A�Q��*y�i�`�!�]�!�-f���v���G��Y�ޜ��t͇�p2��Al.cB*�{p������!���U%�JY����!���q3" 5'ia�:M��^���4'����(��P�$8����sK��X�V0Y�\5�����0PbD;�U���g-�U�!bb���� r،)��b3c5�ALP��W�� !]
Static task
static1
Behavioral task
behavioral1
Sample
Blueberry_Free_External_BEST.exe
Resource
win10v2004-20231023-de
General
-
Target
Blueberry_Free_External_BEST.exe
-
Size
5.5MB
-
MD5
18e9beac2eae569159f655a5fab36646
-
SHA1
5a156ebbbc5d47fc73989388990f37a387b0a266
-
SHA256
d37d776c7e3986f14261ad085c17602e8c617187796d29ffbcef9389f37d00a4
-
SHA512
35880d265cc4f57a33bd52dff98eb29a20d9cf27e9717982920676440fe3fa616a0ba7b28a814e67265952448e7f3343ea1b17d9dc16c6de30346d9fcf1fcb77
-
SSDEEP
98304:nkcn+dDi8lmGWz9L9XPUtdv0Ryh33ZztTwOwaa/Z8QpHzBSPEs:nkZti8l/EL9/sd8Ryh51dFyZXBSs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Blueberry_Free_External_BEST.exe
Files
-
Blueberry_Free_External_BEST.exe.exe windows:6 windows x64
692b50aa8e33e5d8336fddd17e13e901
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
kernel32
GetProcAddress
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetCursor
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
imm32
ImmSetCompositionWindow
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
msvcp140
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
wininet
InternetCloseHandle
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-runtime-l1-1-0
_errno
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
acosf
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 424KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.blueber Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.blueber Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ