blister | 7a0723aff075673ef855b4e615207dfd

Sharing

Copy URL Twitter E-mail

General

Target
7a0723aff075673ef855b4e615207dfd
Size 3.6MB
Sample240127-mtn9rsccgl
SHA256 3cc446d6a658ce7bdf67387d6df73888b2f5ea0a3955f2c11ebdeaec4d589517
MD5 7a0723aff075673ef855b4e615207dfd
SHA1 aa3c1654b4abefe9831f6b60866253b4b8436fe0
SHA512 344444ca7d681f86f0707e5e788c7d20dadbcf8c69cc5afd8a5136e78848737003e5f8320356bd25d0773fb90e3ec0fe2c55d32e6923e43640b6ce204c4ade7c
SSDEEP 98304:XTjwlh++gsHbQN/muXMxx2FKPv2QXMojZ5nYu3zSXYwREF0aQ:XTjKz7gF42kWQXMIjnYu+ow7J
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

loader blister

Malware Config

Signatures

Blister family
blister

Detect Blister loader x32 1 IoCs

loader

resource	yara_rule
static1/unpack001/$TEMP/bibs_work/WMVCORE.DLL	family_blister_x32

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
7a0723aff075673ef855b4e615207dfd
unpack001/$TEMP/bibs_work/WMVCORE.DLL

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

7a0723aff075673ef855b4e615207dfd

.exe 3.6MB
$TEMP/bibs_work/WMVCORE.DLL

.dll 4.9MB

7a0723aff075673ef855b4e615207dfd

IMPHASH 3abe302b6d9a1256e6a915429af4ffd2
SHA256 3cc446d6a658ce7bdf67387d6df73888b2f5ea0a3955f2c11ebdeaec4d589517
MD5 7a0723aff075673ef855b4e615207dfd
SHA1 aa3c1654b4abefe9831f6b60866253b4b8436fe0
SHA512 344444ca7d681f86f0707e5e788c7d20dadbcf8c69cc5afd8a5136e78848737003e5f8320356bd25d0773fb90e3ec0fe2c55d32e6923e43640b6ce204c4ade7c
SSDEEP 98304:XTjwlh++gsHbQN/muXMxx2FKPv2QXMojZ5nYu3zSXYwREF0aQ:XTjKz7gF42kWQXMIjnYu+ow7J
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12812

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA Sleep GetTickCount GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GetWindowsDirectoryA SetCurrentDirectoryA GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileAttributesA GetFileAttributesA GetShortPathNameA MoveFileA GetFullPathNameA SetFileTime SearchPathA CloseHandle lstrcmpiA CreateThread GlobalLock lstrcmpA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$TEMP/bibs_work/WMVCORE.DLL

IMPHASH 3b2efd14033548a4d479d8e23d8b6ee7
SHA256 8c981acb2673fa80fa39aa2ba9b1916cb9866b5e8f9ec1cc98bc7fed36b49c61
MD5 88fba76c3a7eb0f785903de05fb0bd06
SHA1 35f452a43a838cbad695d596b2cad144cc115074
SHA512 f0bfb7e85de0834c3a3a8448ba4d218d28608b3634bed24590a30e91acb51632b01b09f3734547bca383c8d69a8e4c754337fa7d44a274c458fca04d21c29876
SSDEEP 98304:LXIbjOdRTNhVNwb64wmsBtA8x2nKXp8SXUMjR7VOMRf2TYwTkZ0032:jI4T9N/esBO62KSSXU0FVOM8Uwz
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:6 windows x86 arch:x86

Detect Blister loader x32

loader
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

127682

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wmvcore.pdb

wmasf

ord9 ord24 ASFSetDataUnitInfo ASFGetTimeBase ASFCreateStreamSelector ord18 ASFPresTimeToTime ASFSendTimeToTime ASFTimeToSendTime ASFTimeToPresTime ord10 ord6 ord8 ord17 ord7 ord5 ord11

msvcrt

??1type_info@@UAE@XZ _onexit _lock __dllonexit _unlock _amsg_exit _initterm malloc _ultow _wtol __CxxFrameHandler3 _except_handler4_common strncmp sscanf isspace strstr _stricmp isalnum realloc free _waccess swscanf_s _wcsupr wcsstr wcstol _itow wcstombs memchr strpbrk _wcslwr memmove _beginthreadex srand rand ??_V@YAXPAX@Z _ftol2_sse _wtoi wcstoul swscanf _ftol2 setlocale iswspace _ultoa iswdigit strcspn strspn floor ceil _CIsin _CIcos toupper isxdigit iswcntrl iswascii wcsspn wcscspn _ltoa isalpha wcsftime gmtime perror _ftol printf ??_U@YAPAXI@Z _vsnwprintf _vsnprintf _strnicmp wcsrchr wcschr wcspbrk wcsncmp _wcsicmp _purecall _set_error_mode ??2@YAPAXI@Z memset memcpy ??3@YAXPAX@Z _wcsnicmp wcsncpy_s _ui64toa _itoa towupper iswprint strtoul _errno isdigit strchr time _CIsqrt _CIpow iswctype wcstok _XcptFilter

advapi32

RegSetValueExA RegCreateKeyExA RegQueryValueExA RegQueryInfoKeyW RegDeleteKeyW RegEnumKeyW RegSetValueExW RegCreateKeyExW RegEnumValueW GetUserNameW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCloseKey TraceEvent RegOpenKeyW CryptAcquireContextA CryptReleaseContext CryptGenRandom

kernel32

InitializeCriticalSectionAndSpinCount VirtualProtect SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess RaiseException LocalAlloc LoadLibraryExA GetCurrentProcessId GetLocalTime GetDiskFreeSpaceA GetEnvironmentStringsW GetEnvironmentStrings lstrlenW FreeEnvironmentStringsW FreeEnvironmentStringsA DeviceIoControl GetVersionExA LocalFree GetVersion GetModuleHandleA GetSystemInfo HeapReAlloc SetLastError QueryPerformanceCounter CreateThread GetExitCodeThread GetCurrentThread GetThreadPriority SetThreadPriority CreateSemaphoreA SetEndOfFile GetFileTime FileTimeToSystemTime GetLocaleInfoW FindAtomW GetModuleFileNameW GetUserDefaultLCID GetSystemDefaultLangID GetVersionExW GlobalAlloc GlobalLock GetProcAddress LoadLibraryW WaitForSingleObjectEx ReleaseMutex CreateMutexW GlobalMemoryStatus VirtualAlloc VirtualFree MulDiv ResetEvent WaitForMultipleObjects SetThreadAffinityMask SetHandleInformation GetComputerNameW HeapSize GetTempPathW FreeLibraryAndExitThread GetProcessAffinityMask InterlockedExchangeAdd GetExitCodeProcess OpenProcess GetModuleHandleExA SignalObjectAndWait SleepEx DuplicateHandle SetFilePointerEx GetFileSizeEx LoadLibraryA DisableThreadLibraryCalls FreeResource CloseHandle WriteFile CreateFileW GetLastError GetFileAttributesW GetSystemDirectoryW SizeofResource LockResource LoadResource FindResourceW GetModuleHandleW InterlockedCompareExchange InterlockedIncrement HeapAlloc GetProcessHeap HeapFree InterlockedDecrement ReadFile GetFileType DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection SetEvent GetCurrentThreadId SystemTimeToFileTime GetSystemTime WaitForSingleObject GetFileSize ReleaseSemaphore CreateSemaphoreW GetTickCount GetSystemTimeAsFileTime MultiByteToWideChar SetFilePointer GetDiskFreeSpaceExW WideCharToMultiByte lstrlenA CompareFileTime DeleteFileW Sleep CreateEventW FreeLibrary InterlockedExchange GetVolumeInformationW

user32

GetDC GetDesktopWindow ReleaseDC MsgWaitForMultipleObjects DispatchMessageW PeekMessageW PostThreadMessageW CharUpperW

ole32

CLSIDFromString CoGetTreatAsClass StringFromCLSID CoTaskMemAlloc CoCreateGuid CoInitializeEx CoCreateInstance CoUninitialize CoTaskMemFree

oleaut32

SafeArrayAccessData SafeArrayUnaccessData SysAllocStringLen SafeArrayCreate VariantChangeType VariantTimeToSystemTime SysStringByteLen SysStringLen SysAllocString SysFreeString VariantInit VariantCopy VariantClear SafeArrayDestroy

gdi32

GetSystemPaletteEntries

gdiplus

GdiplusShutdown GdipCloneImage GdipDrawImageRectI GdipGetImageGraphicsContext GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream GdipImageRotateFlip GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipDeleteGraphics GdipAlloc GdipFree GdiplusStartup

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

RT_CODE

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

87KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

RT_DATA

Size

512B

Virtual Size

305B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

55KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

7a0723aff075673ef855b4e615207dfd

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$TEMP/bibs_work/WMVCORE.DLL

wmasf

msvcrt

advapi32

kernel32

user32

ole32

oleaut32

gdi32

gdiplus

generic