blister | af175128a823db1274fc244d8f5a46bd

Sharing

Copy URL Twitter E-mail

General

Target
af175128a823db1274fc244d8f5a46bd
Size 16.6MB
Sample240229-wa7fnsga3s
SHA256 fc10619c7cb6b5de6ba8f58fd3ff889045ef77ea4cde4de7c5f313dbef1a7bc3
MD5 af175128a823db1274fc244d8f5a46bd
SHA1 9d67400fb5818a6c573c36eac8650458d7f1d07e
SHA512 2fbd782242a4e57c2563cf4eb46d0bfca337839f126b93eca96a8c9a06377034336770c368da0c703ed2d7907f49d75b722dc688c461de1000e46c32368fe19f
SSDEEP 393216:7Q4l1FoGr1o4X3LKq/LnF+aOeuKAxt9zpaz3y6Jqx5mDsLOVEi:7Q4l1Fo455LnVupJpa2ADsKVT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

loader vmprotect blister

Malware Config

Signatures

Blister family
blister

Detect Blister loader x32 1 IoCs

loader

resource	yara_rule
static1/unpack001/$TEMP/lib_npp/libcef.dll	family_blister_x32

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
static1/unpack001/$TEMP/lib_npp/libcef.dll	vmprotect

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
af175128a823db1274fc244d8f5a46bd
unpack001/$TEMP/lib_npp/libcef.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

af175128a823db1274fc244d8f5a46bd

.exe 16.6MB
$TEMP/lib_npp/libcef.dll

.dll 29.8MB

af175128a823db1274fc244d8f5a46bd

IMPHASH 3abe302b6d9a1256e6a915429af4ffd2
SHA256 fc10619c7cb6b5de6ba8f58fd3ff889045ef77ea4cde4de7c5f313dbef1a7bc3
MD5 af175128a823db1274fc244d8f5a46bd
SHA1 9d67400fb5818a6c573c36eac8650458d7f1d07e
SHA512 2fbd782242a4e57c2563cf4eb46d0bfca337839f126b93eca96a8c9a06377034336770c368da0c703ed2d7907f49d75b722dc688c461de1000e46c32368fe19f
SSDEEP 393216:7Q4l1FoGr1o4X3LKq/LnF+aOeuKAxt9zpaz3y6Jqx5mDsLOVEi:7Q4l1Fo455LnVupJpa2ADsKVT
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12812

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA Sleep GetTickCount GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GetWindowsDirectoryA SetCurrentDirectoryA GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileAttributesA GetFileAttributesA GetShortPathNameA MoveFileA GetFullPathNameA SetFileTime SearchPathA CloseHandle lstrcmpiA CreateThread GlobalLock lstrcmpA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$TEMP/lib_npp/libcef.dll

IMPHASH 71fa7f142f1ee33cc1fefb36d06fdb2c
SHA256 c1e6d8d159d05d34b6d97ff8629c0a266dd7b7c0665f19a5defc33aaa307f5e2
MD5 0e8f94415c1e7694cb6b88bbf17f9339
SHA1 df8be7a1694144e1613300c9e60da321b49fdd79
SHA512 9f09399507b41c50a9838c1a26debcc3a405cc8c2191bbb7ef6d8b52ce443e532ae90ddd03a1f6a0eb50b2e8cd6b42a542872e8d717353692f0ecd82fef1b7ff
SSDEEP 786432:u7GbWhs7Bcgr7wOw/2jt+KOY5rr4/ITehQ57c/RO2Tp7XvQT5:NbWhs7Bcgr7wtKt+KOY5rr4/ITeyc/RK
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Detect Blister loader x32

loader
VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

28531560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\code\chromium_1364\src\cef1\Release\libcef.dll.pdb

kernel32

GetVersionExW VirtualQuery LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

winhttp

WinHttpGetProxyForUrl

ws2_32

WSACloseEvent

psapi

GetProcessMemoryInfo

winmm

timeBeginPeriod

shlwapi

PathGetCharTypeW

comctl32

InitCommonControlsEx

user32

CallMsgFilterW GetProcessWindowStation GetProcessWindowStation GetUserObjectInformationW

gdi32

StretchBlt

winspool.drv

GetPrinterW

comdlg32

GetOpenFileNameW

advapi32

CryptContextAddRef

ole32

ReleaseStgMedium

iphlpapi

CancelIPChangeNotify

urlmon

CoInternetCreateSecurityManager

secur32

EncryptMessage

crypt32

CertRDNValueToStrW

usp10

ScriptItemize

imm32

ImmGetContext

version

GetFileVersionInfoSizeW

wtsapi32

WTSSendMessageW

cef_add_cross_origin_whitelist_entry cef_browser_create cef_browser_create_sync cef_build_revision cef_clear_cross_origin_whitelist cef_clear_scheme_handler_factories cef_command_line_create cef_cookie_manager_create_manager cef_cookie_manager_get_global_manager cef_create_url cef_currently_on cef_do_message_loop_work cef_get_geolocation cef_get_web_plugin_count cef_get_web_plugin_info cef_get_web_plugin_info_byname cef_initialize cef_parse_url cef_post_data_create cef_post_data_element_create cef_post_delayed_task cef_post_task cef_quit_message_loop cef_register_extension cef_register_plugin cef_register_scheme_handler_factory cef_remove_cross_origin_whitelist_entry cef_request_create cef_run_message_loop cef_set_osmodal_loop cef_shutdown cef_stream_reader_create_for_data cef_stream_reader_create_for_file cef_stream_reader_create_for_handler cef_stream_writer_create_for_file cef_stream_writer_create_for_handler cef_string_ascii_to_utf16 cef_string_ascii_to_wide cef_string_list_alloc cef_string_list_append cef_string_list_clear cef_string_list_copy cef_string_list_free cef_string_list_size cef_string_list_value cef_string_map_alloc cef_string_map_append cef_string_map_clear cef_string_map_find cef_string_map_free cef_string_map_key cef_string_map_size cef_string_map_value cef_string_multimap_alloc cef_string_multimap_append cef_string_multimap_clear cef_string_multimap_enumerate cef_string_multimap_find_count cef_string_multimap_free cef_string_multimap_key cef_string_multimap_size cef_string_multimap_value cef_string_userfree_utf16_alloc cef_string_userfree_utf16_free cef_string_userfree_utf8_alloc cef_string_userfree_utf8_free cef_string_userfree_wide_alloc cef_string_userfree_wide_free cef_string_utf16_clear cef_string_utf16_cmp cef_string_utf16_set cef_string_utf16_to_utf8 cef_string_utf16_to_wide cef_string_utf8_clear cef_string_utf8_cmp cef_string_utf8_set cef_string_utf8_to_utf16 cef_string_utf8_to_wide cef_string_wide_clear cef_string_wide_cmp cef_string_wide_set cef_string_wide_to_utf16 cef_string_wide_to_utf8 cef_time_delta cef_time_from_doublet cef_time_from_timet cef_time_now cef_time_to_doublet cef_time_to_timet cef_v8context_get_current_context cef_v8context_get_entered_context cef_v8context_in_context cef_v8stack_trace_get_current cef_v8value_create_array cef_v8value_create_bool cef_v8value_create_date cef_v8value_create_double cef_v8value_create_function cef_v8value_create_int cef_v8value_create_null cef_v8value_create_object cef_v8value_create_string cef_v8value_create_uint cef_v8value_create_undefined cef_web_urlrequest_create cef_xml_reader_create cef_zip_reader_create �{G��k:o|?6_|�5�_+�T%�;��ŔL��x�T��Y]�j�[2�75|<񒵟��S��ͳ�Vd�F��Vf�S�}��$�P1moUUΘʃ�L<��$�a��u�M<(�)��=�$��q�: s��C��ӫ�ݫ�xr��L��.��ɜ��z=n2]<tƴs�k� ��l�FM��h��Ŗ��"./�2��L��h��FDB��?F,l��+c]5�{��{ڌ��ݷ�% �G�e̾�jj_gp��@�Q�e�!�O�P�;�deJ`�sI��5f��d#u�" E��cnh��%��1��*�?j"��t�^٤��BF .k�x10�!u�F�]%��n�Y0#Ԃ¹��7-۸�dGl�(��U>�K��F��jӌ�.W��r�D��)��KY�G5~2��kt�H��> '&1��,� ��O=�N��|��z�� R2p'_�G�Z�Gd��Hi�*�V�C*˚0Ɲ/<�@� �[W&��iH��3�z�?�qb��;�M��DV�̓X�e��:B��Ƶ&� '�t��珕�Z�ȋ�K�`A�=�ۺ�� Dn��X�^�9��KY��(�S�Fk>�:�8��5��0@�U�Pc�YǦ$�VL�bxbK^9.�,�Z�)��)��4$��q:�Ur�vS� ,H��<��Y��s��)S��)�'�@s�t��|˄��'�B$'b�0G�Ȼū��G�@��So��K��Eb��wv��*��򗎱�KŢ�Z��=/��e�A�燚 ��֜��l�'�H4� ��Q8e�탫~Md˜��(<l�೼>4�/�u��2g<��l��9M_�$w�-��Rt��M��E�۽/��*W��:g>��m�܏w��c�Q��.�Lho~��Iv��U[��z��;�P�6�M��Z�pmt83�.�0��C$��;�k9�/��+g(�.g} �@��s ��h�'P�r�.��,��"��k�m�q��l��]Y��/I&�r;ԧ�L��Z?�8Qy��{�^M�̜�a?�_& [�DM:�� Ć��gr]B�=ML��EFl��<��菑�i�oD��7�jgcm�"[Qђ��]]�S;w��7a�]�8�^�X�?� .�[ƀ��"��d2�>�?RUb)�� h�u�z��X�%U��B��E�'"�p?{(��%�ģ� ��X��|s,-_ĊZ��c��b��ݱNθ�Y��'ښYC�|7ᚲ,��L�za��V��~_JpbX� �j�Z��l��3��ebq��6��\��=BmHÍ8<}��q�~�շ��x^��Iy�,i$7��$S�� "]V�ߚ��!��c)-��1�=�}M�\��kC�r��tZ��\�:��k��o��M�nib��J��l��ӄpH�h ��;H�&-5'Sy� g� X��C�bAar-��遬b(@0�8$��7\�}TFv��*��@� <�{=��G�3ѣ}<�+o��t��Τ�PW��q��tD�.��W��s[�5_B��C�9�k EF��A�b�#��utt/�PL�m�<#vѱ��g�7�|@P<hi�E �Zԁ�^�M��S96� �sDdT�(m�!��s�Bg��['=7:(c}�-��VI]�n�j�"o'��7�:�g/��>5-� S�`��9%m��<��u�� n�(�O(�`�]�,�p/rTt�� T4�ل�N�A��֛��%ǠX�m;��~�~��>�|csR3_񙽊1��Tx1�'@�="�� q�4ʽAS�94�L��=�U��3r6V��v�N&��~�b��)�2��>O$ ��%�i6j%d��j�T8��~��$�n#5<1��AN��f�g�(��&��c��"��a�&��e�cbm��C��dO q?��!�� 1��r@�e�rԿ<p�*�z��!�Wެ9�pĲЌ��q�3~m*>3D��k[kL&`L�7��M�ײ�z·˸�^WӮJ��}m��_^�h�0n��,�B�V�&L��uZ7�+c��m,F��:��m��Kp\��;��CEB ��`N�n��Dv�3e�9��i��|Ȟ�=TW��wGw�񮳾�b�@��_�k�� R��-�e}��a ��7J�B튓�7zr��"2��v}YP�*֋��Z��?1��F� '��\:��y˞�i��]b9f��w$�$� r�\ۖ�Ý��ֽ� �X��I7�֎��(�F��Q�ֽC}4�KST�0yX��m�Y\��I��U�0��[��b�V��.��o�5*�휭G��%�s��@yj�e�N��:�h�r��y��ȿ6��<�Ԭ�͋�l|�ji,d�u[��u?iP8�')57��?a��eW@�� ]�W�j�,��rI��-Z�S'�_~4��'U%&m �� ?h)7��m㕫ji��KZ�r�}�9�Ժ��ѭ��/�y��Z� hA໒V�$I�Fpn��@`>�b~��̟�8=!F��|��)"�3�X�_9��q�f�жo�E�ͬ�a!�t; ��j"�C��^�$NDڴi��R��x*ێ�W򲹹�8�D<}�M!��^�yl�d6�Ma�m��p/⬃�+��L9V`.��$��*^��o�K��c/��V�\��ci:��$ѽ��YA1(w� ��+_[��o�AN��ꚴ��3i�� 18prw_��K�� i��,Ʊ��m|fJ<�B��]rL��Ru�E!K�2ͺ2bQ��&�O[Y��

Name

.text

Size

18.8MB

Virtual Size

18.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

185KB

Virtual Size

447KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.unwante

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

762KB

Virtual Size

762KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

495KB

Virtual Size

494KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

af175128a823db1274fc244d8f5a46bd

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$TEMP/lib_npp/libcef.dll

kernel32

winhttp

ws2_32

psapi

winmm

shlwapi

comctl32

user32

gdi32

winspool.drv

comdlg32

advapi32

ole32

iphlpapi

urlmon

secur32

crypt32

usp10

imm32

version

wtsapi32

generic