blister | f91e23d2d279086f5457d7af1dba0ccd_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
f91e23d2d279086f5457d7af1dba0ccd_JaffaCakes118
Size 4.9MB
Sample240419-azq94abe27
SHA256 42b2cd4dad1ea294300fdb103915ee535587e7f90288cab710b659467234fe82
MD5 f91e23d2d279086f5457d7af1dba0ccd
SHA1 d3ea37c75227f62df1c107ed43afe2d1c9598e5c
SHA512 11c7bae7c3e41fce23c09f3cdcc78201beba82810bd9b0877d21faa61e32a3e9bf098c73faa81e96333fda8ce8f434e28375f4c14ab9596bd1091ed7785baa0d
SSDEEP 98304:0XJbjOdRTNhVNwb64wmsBtAJzVTx+HzF0dFGNi0mSG6GH63Ju6eGj:mJ4T9N/esBOJz9xoh03G0fP63JuQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

loader blister

Malware Config

Signatures

Blister family
blister

Detect Blister loader x32 1 IoCs

loader

resource	yara_rule
sample	family_blister_x32

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f91e23d2d279086f5457d7af1dba0ccd_JaffaCakes118

File Explorer

f91e23d2d279086f5457d7af1dba0ccd_JaffaCakes118

.dll 4.9MB

f91e23d2d279086f5457d7af1dba0ccd_JaffaCakes118

IMPHASH 3b2efd14033548a4d479d8e23d8b6ee7
SHA256 42b2cd4dad1ea294300fdb103915ee535587e7f90288cab710b659467234fe82
MD5 f91e23d2d279086f5457d7af1dba0ccd
SHA1 d3ea37c75227f62df1c107ed43afe2d1c9598e5c
SHA512 11c7bae7c3e41fce23c09f3cdcc78201beba82810bd9b0877d21faa61e32a3e9bf098c73faa81e96333fda8ce8f434e28375f4c14ab9596bd1091ed7785baa0d
SSDEEP 98304:0XJbjOdRTNhVNwb64wmsBtAJzVTx+HzF0dFGNi0mSG6GH63Ju6eGj:mJ4T9N/esBOJz9xoh03G0fP63JuQ
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:6 windows x86 arch:x86

Detect Blister loader x32

loader
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

127682

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wmvcore.pdb

wmasf

ord9 ord24 ASFSetDataUnitInfo ASFGetTimeBase ASFCreateStreamSelector ord18 ASFPresTimeToTime ASFSendTimeToTime ASFTimeToSendTime ASFTimeToPresTime ord10 ord6 ord8 ord17 ord7 ord5 ord11

msvcrt

??1type_info@@UAE@XZ _onexit _lock __dllonexit _unlock _amsg_exit _initterm malloc _ultow _wtol __CxxFrameHandler3 _except_handler4_common strncmp sscanf isspace strstr _stricmp isalnum realloc free _waccess swscanf_s _wcsupr wcsstr wcstol _itow wcstombs memchr strpbrk _wcslwr memmove _beginthreadex srand rand ??_V@YAXPAX@Z _ftol2_sse _wtoi wcstoul swscanf _ftol2 setlocale iswspace _ultoa iswdigit strcspn strspn floor ceil _CIsin _CIcos toupper isxdigit iswcntrl iswascii wcsspn wcscspn _ltoa isalpha wcsftime gmtime perror _ftol printf ??_U@YAPAXI@Z _vsnwprintf _vsnprintf _strnicmp wcsrchr wcschr wcspbrk wcsncmp _wcsicmp _purecall _set_error_mode ??2@YAPAXI@Z memset memcpy ??3@YAXPAX@Z _wcsnicmp wcsncpy_s _ui64toa _itoa towupper iswprint strtoul _errno isdigit strchr time _CIsqrt _CIpow iswctype wcstok _XcptFilter

advapi32

RegSetValueExA RegCreateKeyExA RegQueryValueExA RegQueryInfoKeyW RegDeleteKeyW RegEnumKeyW RegSetValueExW RegCreateKeyExW RegEnumValueW GetUserNameW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCloseKey TraceEvent RegOpenKeyW CryptAcquireContextA CryptReleaseContext CryptGenRandom

kernel32

InitializeCriticalSectionAndSpinCount VirtualProtect SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess RaiseException LocalAlloc LoadLibraryExA GetCurrentProcessId GetLocalTime GetDiskFreeSpaceA GetEnvironmentStringsW GetEnvironmentStrings lstrlenW FreeEnvironmentStringsW FreeEnvironmentStringsA DeviceIoControl GetVersionExA LocalFree GetVersion GetModuleHandleA GetSystemInfo HeapReAlloc SetLastError QueryPerformanceCounter CreateThread GetExitCodeThread GetCurrentThread GetThreadPriority SetThreadPriority CreateSemaphoreA SetEndOfFile GetFileTime FileTimeToSystemTime GetLocaleInfoW FindAtomW GetModuleFileNameW GetUserDefaultLCID GetSystemDefaultLangID GetVersionExW GlobalAlloc GlobalLock GetProcAddress LoadLibraryW WaitForSingleObjectEx ReleaseMutex CreateMutexW GlobalMemoryStatus VirtualAlloc VirtualFree MulDiv ResetEvent WaitForMultipleObjects SetThreadAffinityMask SetHandleInformation GetComputerNameW HeapSize GetTempPathW FreeLibraryAndExitThread GetProcessAffinityMask InterlockedExchangeAdd GetExitCodeProcess OpenProcess GetModuleHandleExA SignalObjectAndWait SleepEx DuplicateHandle SetFilePointerEx GetFileSizeEx LoadLibraryA DisableThreadLibraryCalls FreeResource CloseHandle WriteFile CreateFileW GetLastError GetFileAttributesW GetSystemDirectoryW SizeofResource LockResource LoadResource FindResourceW GetModuleHandleW InterlockedCompareExchange InterlockedIncrement HeapAlloc GetProcessHeap HeapFree InterlockedDecrement ReadFile GetFileType DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection SetEvent GetCurrentThreadId SystemTimeToFileTime GetSystemTime WaitForSingleObject GetFileSize ReleaseSemaphore CreateSemaphoreW GetTickCount GetSystemTimeAsFileTime MultiByteToWideChar SetFilePointer GetDiskFreeSpaceExW WideCharToMultiByte lstrlenA CompareFileTime DeleteFileW Sleep CreateEventW FreeLibrary InterlockedExchange GetVolumeInformationW

user32

GetDC GetDesktopWindow ReleaseDC MsgWaitForMultipleObjects DispatchMessageW PeekMessageW PostThreadMessageW CharUpperW

ole32

CLSIDFromString CoGetTreatAsClass StringFromCLSID CoTaskMemAlloc CoCreateGuid CoInitializeEx CoCreateInstance CoUninitialize CoTaskMemFree

oleaut32

SafeArrayAccessData SafeArrayUnaccessData SysAllocStringLen SafeArrayCreate VariantChangeType VariantTimeToSystemTime SysStringByteLen SysStringLen SysAllocString SysFreeString VariantInit VariantCopy VariantClear SafeArrayDestroy

gdi32

GetSystemPaletteEntries

gdiplus

GdiplusShutdown GdipCloneImage GdipDrawImageRectI GdipGetImageGraphicsContext GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream GdipImageRotateFlip GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipDeleteGraphics GdipAlloc GdipFree GdiplusStartup

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

RT_CODE

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

87KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

RT_DATA

Size

512B

Virtual Size

305B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

55KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f91e23d2d279086f5457d7af1dba0ccd_JaffaCakes118

wmasf

msvcrt

advapi32

kernel32

user32

ole32

oleaut32

gdi32

gdiplus

generic