General

Malware Config

Signatures

Files

• BlueStacksMicroInstaller_4.280.1.1002_native_e8c808cb017c46f465f6562b28124796.exe

  .exe windows:4 windows x86 arch:x86

  32569d67dc210c5cb9a759b08da2bdb3

  
  

  Code Sign

  19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  04-03-2014 00:00

  Not After

  03-03-2024 23:59

  Subject

  CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  33:fd:b6:c8:ea:3c:6a:c8:c4:85:e9:fe:1d:df:f6:84

  Certificate

  Issuer

  CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  10-12-2019 00:00

  Not After

  07-06-2021 23:59

  Subject

  SERIALNUMBER=4559077,CN=BlueStack Systems\, Inc.,O=BlueStack Systems\, Inc.,L=Campbell,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130843616d7062656c6c,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  61:19:93:e4:00:00:00:00:00:1c

  Certificate

  Issuer

  CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  22-02-2011 19:25

  Not After

  22-02-2021 19:35

  Subject

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  07

  Certificate

  Issuer

  CN=Starfield Root Certificate Authority - G2,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

  Not Before

  03-05-2011 07:00

  Not After

  03-05-2031 07:00

  Subject

  CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0b:e6:3a:c9:92:ef:67:ba

  Certificate

  Issuer

  CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

  Not Before

  09-09-2020 07:00

  Not After

  09-09-2025 07:00

  Subject

  CN=Starfield Timestamp Authority - G2,O=Starfield Technologies\, LLC,L=Scottsdale,ST=Arizona,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  e5:da:7b:c3:43:87:f4:4d:24:a5:ea:1e:08:d2:32:92:cc:a6:73:d8:e0:d5:ec:a2:be:22:55:c7:90:6d:cd:90

  Signer

  Actual PE Digest

  e5:da:7b:c3:43:87:f4:4d:24:a5:ea:1e:08:d2:32:92:cc:a6:73:d8:e0:d5:ec:a2:be:22:55:c7:90:6d:cd:90

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  oleaut32

  SysStringLen

  SysAllocStringLen

  VariantClear

  user32

  DialogBoxParamW

  SetWindowLongW

  GetWindowLongW

  GetDlgItem

  LoadStringW

  CharUpperW

  DestroyWindow

  EndDialog

  PostMessageW

  SetWindowTextW

  ShowWindow

  MessageBoxW

  SendMessageW

  LoadIconW

  KillTimer

  SetTimer

  shell32

  ShellExecuteExW

  msvcrt

  _controlfp

  __set_app_type

  __p__fmode

  __p__commode

  _adjust_fdiv

  __setusermatherr

  _initterm

  __getmainargs

  _acmdln

  exit

  _XcptFilter

  _exit

  ?terminate@@YAXXZ

  ??1type_info@@UAE@XZ

  _except_handler3

  _beginthreadex

  memset

  wcsstr

  free

  malloc

  memcpy

  _CxxThrowException

  _purecall

  memmove

  memcmp

  wcscmp

  __CxxFrameHandler

  kernel32

  WaitForSingleObject

  GetStartupInfoA

  InitializeCriticalSection

  ResetEvent

  SetEvent

  CreateEventW

  lstrlenW

  lstrcatW

  VirtualFree

  VirtualAlloc

  Sleep

  WaitForMultipleObjects

  GetFileInformationByHandle

  GetStdHandle

  GlobalMemoryStatus

  GetSystemInfo

  GetCurrentProcess

  GetProcessAffinityMask

  SetEndOfFile

  WriteFile

  ReadFile

  SetFilePointer

  GetFileSize

  GetFileAttributesW

  GetModuleHandleA

  FindNextFileW

  FindFirstFileW

  FindClose

  GetCurrentThreadId

  GetTickCount

  GetCurrentProcessId

  GetTempPathW

  GetCurrentDirectoryW

  SetCurrentDirectoryW

  SetLastError

  DeleteFileW

  CreateDirectoryW

  GetModuleHandleW

  GetProcAddress

  RemoveDirectoryW

  SetFileAttributesW

  CreateFileW

  SetFileTime

  GetSystemDirectoryW

  FormatMessageW

  LocalFree

  GetModuleFileNameW

  LoadLibraryExW

  DeleteCriticalSection

  EnterCriticalSection

  LeaveCriticalSection

  GetLastError

  GetVersionExW

  GetCommandLineW

  CreateProcessW

  CloseHandle

  Sections

  .text

  Size: 102KB - Virtual size: 101KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 15KB - Virtual size: 14KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .sxdata

  Size: 512B - Virtual size: 4B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 347KB - Virtual size: 347KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ