C:\code\chromium_1364\src\cef1\Release\libcef.dll.pdb
Behavioral task
behavioral1
Sample
af175128a823db1274fc244d8f5a46bd.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
af175128a823db1274fc244d8f5a46bd.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$TEMP/lib_npp/libcef.dll
Resource
win7-20240221-en
General
-
Target
af175128a823db1274fc244d8f5a46bd
-
Size
16.6MB
-
MD5
af175128a823db1274fc244d8f5a46bd
-
SHA1
9d67400fb5818a6c573c36eac8650458d7f1d07e
-
SHA256
fc10619c7cb6b5de6ba8f58fd3ff889045ef77ea4cde4de7c5f313dbef1a7bc3
-
SHA512
2fbd782242a4e57c2563cf4eb46d0bfca337839f126b93eca96a8c9a06377034336770c368da0c703ed2d7907f49d75b722dc688c461de1000e46c32368fe19f
-
SSDEEP
393216:7Q4l1FoGr1o4X3LKq/LnF+aOeuKAxt9zpaz3y6Jqx5mDsLOVEi:7Q4l1Fo455LnVupJpa2ADsKVT
Malware Config
Signatures
-
Blister family
-
Detect Blister loader x32 1 IoCs
resource yara_rule static1/unpack001/$TEMP/lib_npp/libcef.dll family_blister_x32 -
resource yara_rule static1/unpack001/$TEMP/lib_npp/libcef.dll vmprotect -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource af175128a823db1274fc244d8f5a46bd unpack001/$TEMP/lib_npp/libcef.dll -
NSIS installer 2 IoCs
resource yara_rule sample nsis_installer_1 sample nsis_installer_2
Files
-
af175128a823db1274fc244d8f5a46bd.exe windows:4 windows x86 arch:x86
3abe302b6d9a1256e6a915429af4ffd2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTempPathA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetEnvironmentVariableA
Sleep
GetTickCount
GetCommandLineA
lstrlenA
GetVersion
SetErrorMode
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GetWindowsDirectoryA
SetCurrentDirectoryA
GetLastError
CreateDirectoryA
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
ReadFile
WriteFile
lstrcpyA
MoveFileExA
lstrcatA
GetSystemDirectoryA
GetProcAddress
GetExitCodeProcess
WaitForSingleObject
CompareFileTime
SetFileAttributesA
GetFileAttributesA
GetShortPathNameA
MoveFileA
GetFullPathNameA
SetFileTime
SearchPathA
CloseHandle
lstrcmpiA
CreateThread
GlobalLock
lstrcmpA
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
GetPrivateProfileStringA
FindClose
MultiByteToWideChar
FreeLibrary
MulDiv
WritePrivateProfileStringA
LoadLibraryExA
GetModuleHandleA
GlobalAlloc
GlobalFree
ExpandEnvironmentStringsA
user32
ScreenToClient
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
PostQuitMessage
GetWindowRect
EnableMenuItem
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndDialog
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
GetDC
CreateDialogParamA
SetTimer
GetDlgItem
SetWindowLongA
SetForegroundWindow
LoadImageA
IsWindow
SendMessageTimeoutA
FindWindowExA
OpenClipboard
TrackPopupMenu
AppendMenuA
EndPaint
DestroyWindow
wsprintfA
ShowWindow
SetWindowTextA
gdi32
SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
ShellExecuteExA
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
SHFileOperationA
advapi32
AdjustTokenPrivileges
RegCreateKeyExA
RegOpenKeyExA
SetFileSecurityA
OpenProcessToken
LookupPrivilegeValueA
RegEnumValueA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Sections
.text Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 149KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: - Virtual size: 32KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
$TEMP/lib_npp/libcef.dll.dll windows:5 windows x86 arch:x86
71fa7f142f1ee33cc1fefb36d06fdb2c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetVersionExW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
winhttp
WinHttpGetProxyForUrl
ws2_32
WSACloseEvent
psapi
GetProcessMemoryInfo
winmm
timeBeginPeriod
shlwapi
PathGetCharTypeW
comctl32
InitCommonControlsEx
user32
CallMsgFilterW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
StretchBlt
winspool.drv
GetPrinterW
comdlg32
GetOpenFileNameW
advapi32
CryptContextAddRef
ole32
ReleaseStgMedium
iphlpapi
CancelIPChangeNotify
urlmon
CoInternetCreateSecurityManager
secur32
EncryptMessage
crypt32
CertRDNValueToStrW
usp10
ScriptItemize
imm32
ImmGetContext
version
GetFileVersionInfoSizeW
wtsapi32
WTSSendMessageW
Exports
Exports
cef_add_cross_origin_whitelist_entry
cef_browser_create
cef_browser_create_sync
cef_build_revision
cef_clear_cross_origin_whitelist
cef_clear_scheme_handler_factories
cef_command_line_create
cef_cookie_manager_create_manager
cef_cookie_manager_get_global_manager
cef_create_url
cef_currently_on
cef_do_message_loop_work
cef_get_geolocation
cef_get_web_plugin_count
cef_get_web_plugin_info
cef_get_web_plugin_info_byname
cef_initialize
cef_parse_url
cef_post_data_create
cef_post_data_element_create
cef_post_delayed_task
cef_post_task
cef_quit_message_loop
cef_register_extension
cef_register_plugin
cef_register_scheme_handler_factory
cef_remove_cross_origin_whitelist_entry
cef_request_create
cef_run_message_loop
cef_set_osmodal_loop
cef_shutdown
cef_stream_reader_create_for_data
cef_stream_reader_create_for_file
cef_stream_reader_create_for_handler
cef_stream_writer_create_for_file
cef_stream_writer_create_for_handler
cef_string_ascii_to_utf16
cef_string_ascii_to_wide
cef_string_list_alloc
cef_string_list_append
cef_string_list_clear
cef_string_list_copy
cef_string_list_free
cef_string_list_size
cef_string_list_value
cef_string_map_alloc
cef_string_map_append
cef_string_map_clear
cef_string_map_find
cef_string_map_free
cef_string_map_key
cef_string_map_size
cef_string_map_value
cef_string_multimap_alloc
cef_string_multimap_append
cef_string_multimap_clear
cef_string_multimap_enumerate
cef_string_multimap_find_count
cef_string_multimap_free
cef_string_multimap_key
cef_string_multimap_size
cef_string_multimap_value
cef_string_userfree_utf16_alloc
cef_string_userfree_utf16_free
cef_string_userfree_utf8_alloc
cef_string_userfree_utf8_free
cef_string_userfree_wide_alloc
cef_string_userfree_wide_free
cef_string_utf16_clear
cef_string_utf16_cmp
cef_string_utf16_set
cef_string_utf16_to_utf8
cef_string_utf16_to_wide
cef_string_utf8_clear
cef_string_utf8_cmp
cef_string_utf8_set
cef_string_utf8_to_utf16
cef_string_utf8_to_wide
cef_string_wide_clear
cef_string_wide_cmp
cef_string_wide_set
cef_string_wide_to_utf16
cef_string_wide_to_utf8
cef_time_delta
cef_time_from_doublet
cef_time_from_timet
cef_time_now
cef_time_to_doublet
cef_time_to_timet
cef_v8context_get_current_context
cef_v8context_get_entered_context
cef_v8context_in_context
cef_v8stack_trace_get_current
cef_v8value_create_array
cef_v8value_create_bool
cef_v8value_create_date
cef_v8value_create_double
cef_v8value_create_function
cef_v8value_create_int
cef_v8value_create_null
cef_v8value_create_object
cef_v8value_create_string
cef_v8value_create_uint
cef_v8value_create_undefined
cef_web_urlrequest_create
cef_xml_reader_create
cef_zip_reader_create
�{G��k:o|?6_|�5�_+�T%�;��ŔL���x�T���Y]�j�[2�75|<��S��ͳ�Vd�F��Vf�S�}�����$�P1moUUΘʃ�L<���$�a��u�M<(�)���=�$������q�: s��C��ӫ�ݫ�xr�����L��.����ɜ����z=n2]<tƴs�k� ���l�FM���h����Ŗ��"./�2��L��h����FDB��?F,l��+c]5�{����{ڌ��ݷ�% �G�e̾�jj_gp��@�Q�e�!�O�P�;�deJ`�sI���5f��d#u�" E���cnh��%����1���*�?j"��t�^٤����BF .k�x10�!u�F�]%����n�Y0#Ԃ¹��7-۸�dGl�(���U>�K��F��jӌ�.W������r�D������)������KY�G5~2����kt�H����> '&1��,� ���O=�N���|��z������ �R2p'_�G�Z�Gd���Hi�*�V�C*˚0Ɲ/<�@� �[W&���iH���3�z�?�qb��;�M���DV�̓X�e����:B��Ƶ&� '�t��珕�Z�ȋ�K�`A�=�ۺ�� Dn��X�^�9����������KY��(�S�Fk>�:�8��5��0@�U�Pc�YǦ$�VL�bxbK^9.�,�Z�)���)���4$��q:�Ur�vS� ,H��<���Y��s��)S�������)�'�@s�t����|˄����'�B$'b�0G�Ȼū����G�@��So��K��Eb���wv����*���KŢ�Z��=/��e�A�燚 ���֜����l�'�H4� �������Q8e�탫~Md˜��(<l�>4�/�u����2g<���l���9M_�$w�-��Rt���M��E�۽/��*W����:g>���m�w������c�Q��.�Lho~���Iv���U[������z���;�P�6�M��Z�pmt83�.�0���C$���;�k9�/�����+g(�.g} �@�����s ������h�'P�r�.��,����"�����k�m�q��l��]Y��/I&�r;ԧ�L��Z?�8Qy��{�^M�̜�a?�_& [�DM:�� �Ć���gr]B�=ML���EFl��<��菑�i�oD���������7�jgcm�"[Qђ���]]�S;w���������7a�]�8�^�X�?� .�[ƀ��"���d2�>�?RUb)��� � �h�u�z����X�%U�����B���E�'"�p?{(��%�ģ� ����X��|s,-_ĊZ���c�����b�����ݱNθ�Y���'ښYC�|7ᚲ,������L�za��V��~_JpbX� �j�Z���l��3��ebq��6����\����=BmHÍ8<}��q�~�շ��x^��Iy�,i$7��$S�������� "]V�ߚ��!��c)-���1�=�}M�\������kC�r��tZ��\�:�����k��o��M�nib����J�����l���ӄpH�h ���;H�&-5'Sy� g� X��C�bAar-���遬b(@0�8$��7\�}TFv����*���@� <�{=����G�3ѣ}<�+o��t��Τ�PW��q���tD�.��W������s[�5_B����C�9�k EF��A�b�#��utt/�PL�m�<#vѱ�����g�7�|@P<hi�E �Zԁ�^�M��S96� �sDdT�(m�!�����s�Bg��['=7:(c}�-��VI]�n�j�"o'��7�:�g/��>5-� S�`���9%m��<���u����� �n�(�O(�`�]�,�p/rTt�� T4�ل�N�A��֛��%ǠX�m;�����~�~���>�|csR3_1����Tx1�'@�="��� q�4ʽAS�94�L��=�U��3r6V��v�N&��~�b��)�2��>O$ �����%�i6j%d����j�T8��~��$�n#5<1���AN���f�g�(���&���c���"��a�&��e�cbm��C��dO q?��!������� 1��r@�e�rԿ<p�*�z��!�Wެ9�pIJЌ������q�3~m*>3D��k[kL&`L�7��M�ײ�z·˸�^WӮJ���}m��_^�h�0n�����,�B�V�&L����uZ7�+c�������m,F����:���m��Kp\��;��CEB ���`N�n��Dv�3e�9��i���|Ȟ�=TW����wGw��b�@����_�k�� R���-�e}����a ���7J�B튓�7zr��"2��v}YP�*���Z��?1��F� '����\:��y˞�i��]b9f���w$�$� r�\ۖ�Ý��ֽ� �X����I7�֎��(�F��Q�ֽC}4�KST�0yX���m�Y\���I���U�0��[��b�V���.�����o�5*�휭G��%�s���@yj�e�N���:�h�r�������y��ȿ6��<�Ԭ�͋�l|�ji,d�u[������u?iP8�')57��?a���eW@�� ]�W�j�,��rI���-Z�S'�_~4������'U%&m ������ � ��?h)7��������m㕫ji�������KZ�r�}�9�Ժ����ѭ���/�y���Z� hA໒V�$I�Fpn����@`>�b~��̟�8=!F��|��)"�3�X�_9��q�f�жo�E�ͬ�a!�t; �����j"�C���^�$NDڴi��R��x*ێ�W�8�D<}�M!����^�yl�d6�Ma�m���p/⬃�+���L9V`.�����$��*^��o�K��c/��V�\���ci:��$ѽ��YA1(w� ��+_[�����o�AN��ꚴ���3i�� �18prw_��K�������� ��i�������,Ʊ��m|fJ<�B��]rL��Ru�E!K�2ͺ2bQ����&�O[Y��
Sections
.text Size: 18.8MB - Virtual size: 18.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3.4MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 185KB - Virtual size: 447KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.unwante Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 4.3MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 762KB - Virtual size: 762KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 495KB - Virtual size: 494KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ