BlueSoleil[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

BlueSoleil.exe
Size

501KB
MD5

7e0bb3867f1a165b832ee0e12109b594
SHA1

82c9dcc28cf806ebd3fabb45a540320bb9a76a35
SHA256

720e153cfab82049e6b1180ed6ee8fe524b25bd51a40bc4e9125ed44a74567c9
SHA512

f9ce8530ea7d398eb95a1207befd04c41f192f81fcee5eae3419c9e79d9d97ca4a41feccbc1b6de7036da20ace029d35eacc7a159ccadd222d2062d8b1787419
SSDEEP

6144:I7GoEyiO8DujCkLuw1Z39vV0GeSSLBhDA+of:aGgYujCkLuw1Z39vVDeSSQb

Score

1^/10

Malware Config

Signatures

Files

BlueSoleil.exe
.exe windows:5 windows x86 arch:x86

97e7d71492cbd705bbc32eb0474a0239

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

78:72:21:a2:bf:ff:fa:99:d5:b7:19:fc:91:97:76:f0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

18/07/2014, 00:00

Not After

15/09/2017, 23:59

Subject

CN=IVT CORPORATION,O=IVT CORPORATION,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

fc:04:a9:3c:88:5d:bf:ce:88:c2:4d:88:f5:a1:33:b3:d7:b6:4a:6e
Signer

Actual PE Digest

fc:04:a9:3c:88:5d:bf:ce:88:c2:4d:88:f5:a1:33:b3:d7:b6:4a:6e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

ntohl
inet_addr

iphlpapi

GetAdaptersInfo

bsui

Bsui_DispatchMessage
Bsui_ExistBsuiMainWindow
Bsui_Command
Bsui_SetParentWindow
Bsui_InitBsuiMainWindow
Bsui_GetBsuiFrameWnd
Bsui_SetMainWindowCBKFunc

bslangindepres

BsRes_GetResIcon

bscommon

BsCm_IsSNExpired
BsCm_IsSupportBoundBTHWLicenceReg
Bscm_IsAddinNeedAuthorized
Bscm_SetWindowLong
BsCm_IsX64Platform
BsCm_GetCommonSettingFilePath
Bscm_GetWindowLong
BsCm_GetPersonalSettingFilePath
BsCm_IsSupportADFunction

bssdk

Btsdk_RegOpenKey
Btsdk_IsSNLicensed
Btsdk_IsHardwareLicensed
Btsdk_IsMobileActive
Btsdk_IsShowOnlineUpdateMenu
Btsdk_IsNTServiceRunning
Btsdk_IsBluetoothReady
Btsdk_RegQueryIntValue
Btsdk_CheckOLInfo
Btsdk_WritePrivateProfileInt
Btsdk_GetPrivateProfileInt
Btsdk_Done
Btsdk_GetPrivateProfileString
Btsdk_Init
Btsdk_RecordCACount
Btsdk_IsLicensed
Btsdk_FreeMemory
Btsdk_DecryptString
Btsdk_RegCloseKey

shlwapi

StrStrIA
PathFileExistsA
PathFileExistsW

shfolder

SHGetFolderPathA
SHGetFolderPathW

mfc90u

ord3353
ord1675
ord1809
ord1810
ord2208
ord5324
ord5167
ord4631
ord5632
ord4000
ord1222
ord5008
ord639
ord711
ord463
ord6088
ord6183
ord6547
ord5653
ord2470
ord3589
ord5778
ord6822
ord265
ord6811
ord1250
ord6512
ord6168
ord1243
ord5767
ord3637
ord4043
ord4967
ord589
ord3670
ord4905
ord3115
ord6018
ord5663
ord5680
ord4996
ord4347
ord2447
ord5676
ord5674
ord3217
ord2087
ord4213
ord5830
ord6741
ord5548
ord1048
ord4179
ord6035
ord2206
ord2251
ord4747
ord6803
ord4173
ord6801
ord4423
ord4448
ord794
ord1098
ord5933
ord5869
ord665
ord2490
ord406
ord2130
ord3577
ord2282
ord4512
ord814
ord4527
ord938
ord2596
ord4410
ord6095
ord3622
ord4541
ord6666
ord1533
ord2146
ord1357
ord1254
ord6171
ord2904
ord4682
ord3515
ord374
ord6808
ord266
ord1261
ord4774
ord404
ord5535
ord663
ord3187
ord320
ord5770
ord2084
ord1552
ord6604
ord3185
ord1137
ord2326
ord811
ord1047
ord524
ord4324
ord4131
ord744
ord2356
ord3674
ord586
ord797
ord790
ord3286
ord3654
ord595
ord6091
ord1353
ord3486
ord3537
ord1354
ord2537
ord1183
ord3543
ord3488
ord6170
ord1248
ord6514
ord337
ord613
ord5194
ord2592
ord286
ord2694
ord280
ord1298
ord6577
ord6579
ord2106
ord6187
ord5664
ord6065
ord4044
ord2901
ord2097
ord2143
ord636
ord2283
ord1719
ord3355
ord6411
ord1754
ord4660
ord5602
ord6408
ord967
ord2628
ord2610
ord2612
ord3682
ord1442
ord5625
ord1727
ord2966
ord4681
ord580
ord367
ord778
ord782
ord3933
ord2643
ord2644
ord2647
ord2646
ord2645
ord2069
ord2597
ord4543
ord799
ord1599
ord1064
ord909
ord4547
ord813
ord2139
ord5364
ord5656
ord4009
ord600
ord683
ord4550
ord2194
ord1376
ord4549
ord5397
ord4933
ord5382
ord5079
ord5401
ord5491
ord5239
ord5142
ord5230
ord5400
ord4798
ord4797
ord4707
ord5228
ord5384
ord4618
ord5105
ord4942
ord5408
ord4904
ord4955
ord5407
ord5279
ord4927
ord4789
ord4861
ord5487
ord4987
ord5356
ord4945
ord5349
ord4109
ord4866
ord4865
ord5224
ord4622
ord5214
ord4810
ord5418
ord4589
ord4596
ord5016
ord5209
ord4807
ord4823
ord4820
ord4802
ord4805
ord4800
ord5296
ord5293
ord4378
ord3354
ord6410
ord1753
ord1751
ord4345
ord1493
ord4664
ord5601
ord2074
ord5512
ord6800
ord4603
ord3743
ord5154
ord4702
ord1728
ord6466
ord5685
ord5683
ord960
ord969
ord971
ord2615
ord2635
ord2619
ord2625
ord2623
ord2621
ord2638
ord2633
ord2617
ord2640
ord2630
ord2375
ord2368
ord1641
ord6802
ord4174
ord6804
ord3681
ord5404
ord6376
ord3226
ord1440
ord5616
ord1792
ord1791
ord1686
ord5650
ord2771
ord2983
ord3112
ord4728
ord2969
ord3140
ord2774
ord2893
ord2764
ord4080
ord4081
ord4071
ord2891
ord4348
ord4910
ord4693
ord430
ord296
ord3830
ord801
ord965
ord1492
ord6096
ord1272

msvcr90

__setusermatherr
_adjust_fdiv
__p__commode
strcat
__p__fmode
_encode_pointer
__set_app_type
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
_crt_debugger_hook
_configthreadlocale
_XcptFilter
memmove_s
strcpy
_exit
_cexit
__wgetmainargs
_amsg_exit
_vswprintf
_wfopen
fputws
fflush
fclose
_recalloc
calloc
wcsrchr
labs
memcpy_s
?what@exception@std@@UBEPBDXZ
_initterm_e
_initterm
exit
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_wcmdln
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
_invalid_parameter_noinfo
_beginthreadex
memcmp
memcpy
wcsstr
wcscat
malloc
memset
_resetstkoflw
_wtoi
_itow
strlen
_swprintf
_time64
strrchr
wcscpy
wcslen
wcscmp
free
__CxxFrameHandler3

kernel32

lstrcpyW
LocalFree
ResetEvent
GetLastError
GlobalAlloc
ResumeThread
GlobalLock
GlobalUnlock
MulDiv
GlobalFree
WideCharToMultiByte
WinExec
WaitForSingleObject
CloseHandle
CreateEventW
RaiseException
InitializeCriticalSection
DeleteCriticalSection
InterlockedDecrement
OutputDebugStringW
SetEvent
lstrlenW
GetProcAddress
GetModuleHandleW
MultiByteToWideChar
GetModuleFileNameA
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
GetProcessHeap
HeapFree
GetWindowsDirectoryW
GetLocalTime
InterlockedExchange
LoadLibraryW
EnterCriticalSection
LeaveCriticalSection
Sleep
GetSystemDefaultUILanguage
CopyFileW
CreateMutexW
TerminateProcess

user32

SetWindowPos
FillRect
CopyRect
GetSystemMetrics
GetSysColorBrush
InflateRect
ScreenToClient
FindWindowW
SetFocus
SetRect
LoadStringW
OffsetRect
AppendMenuW
GetSystemMenu
DrawIcon
IsIconic
CreateIconIndirect
CreatePopupMenu
SetForegroundWindow
SendMessageW
SetCapture
RedrawWindow
GetCursorPos
DrawIconEx
ReleaseDC
GetWindowRect
PtInRect
DrawTextExW
KillTimer
InvalidateRect
UpdateWindow
SetTimer
LoadCursorW
SetCursor
DestroyCursor
ReleaseCapture
GetDC
EnableWindow
GetParent
GetClientRect
LoadImageW
PostMessageW
SetWindowRgn

gdi32

GetTextExtentPointW
DeleteDC
BitBlt
SetBkMode
GetStockObject
CreateFontW
GetObjectW
GetTextExtentPoint32W
GetTextExtentExPointW
StretchBlt
CreateRectRgnIndirect
CreateRoundRectRgn
CreateDIBSection
SetDIBColorTable
CreatePen
SelectObject
SetPixel
GetPixel
CreateCompatibleBitmap
SetTextColor
SetBkColor
CreateSolidBrush
DeleteObject
CreateCompatibleDC
GetDeviceCaps

advapi32

RegOpenKeyExW
RegCloseKey
RegQueryValueW

shell32

ShellExecuteA
ShellExecuteW

comctl32

_TrackMouseEvent

ole32

CoUninitialize
CoInitialize
CoCreateInstance
CreateStreamOnHGlobal

oleaut32

VariantCopy
SysStringByteLen
VariantClear
SysFreeString
OleLoadPicture
SysAllocString
CreateErrorInfo
SetErrorInfo
VariantChangeType
GetErrorInfo
VariantInit
SysAllocStringByteLen

urlmon

URLDownloadToFileW

msvcp90

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ

gdiplus

GdipBitmapLockBits
GdiplusShutdown
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipFree
GdipDisposeImage
GdipCloneImage
GdipBitmapUnlockBits
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipDrawImageI
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipGetImagePalette
GdiplusStartup
GdipAlloc
GdipCreateBitmapFromScan0

Sections

.text
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 346KB - Virtual size: 346KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

97e7d71492cbd705bbc32eb0474a0239

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

78:72:21:a2:bf:ff:fa:99:d5:b7:19:fc:91:97:76:f0Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

fc:04:a9:3c:88:5d:bf:ce:88:c2:4d:88:f5:a1:33:b3:d7:b6:4a:6eSigner

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

iphlpapi

bsui

bslangindepres

bscommon

bssdk

shlwapi

shfolder

mfc90u

msvcr90

kernel32

user32

gdi32

advapi32

shell32

comctl32

ole32

oleaut32

urlmon

msvcp90

gdiplus

Sections

.text Size: 109KB - Virtual size: 109KB

.rdata Size: 37KB - Virtual size: 37KB

.data Size: 2KB - Virtual size: 7KB

.rsrc Size: 346KB - Virtual size: 346KB

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

78:72:21:a2:bf:ff:fa:99:d5:b7:19:fc:91:97:76:f0
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

fc:04:a9:3c:88:5d:bf:ce:88:c2:4d:88:f5:a1:33:b3:d7:b6:4a:6e
Signer

.text
Size: 109KB - Virtual size: 109KB

.rdata
Size: 37KB - Virtual size: 37KB

.data
Size: 2KB - Virtual size: 7KB

.rsrc
Size: 346KB - Virtual size: 346KB