P�w���Z�4���]i�:���g0(g���C|ş�yz�DG Л�� I��L�����(7As,�������S�[����I��E����\��:<I����2`F}�����g���Z���T;���n�k:yY�[���e�о����@�[=�Kj��$�z7�<���<� ��2: >�n�>�U��R),�2�.�Jl3��@,;�:U%�t�r~5����s@�F|��-ľ�Y�7c=$�ѝ�!�J/�5�k�\u5!lR�i&Hhѥ��2tG�[ſ��}�=��<}����̬���yk����{1d ���q*kW8��B�z�T;�������GK�\���B����� =�Z8w�[�����b�87�_b!ay,��������L+�i���i����P�=�C�ϖO3C[XHP_����v�7�?��R��m�8����3������9�rAD��v!�-� y�bf�� +�^ � X�R3~eDP�i����.��\�U�1HQ�0�t�X���N�Y��DH�,�|d�2X�xw�/"�W�p����Ȏ�B���܀�VE �d���o���Q�>2��i��4�;�\�<�V��& �ɖ#��V3$yv0�o����=�J1�*U{��b��oot&���?(�����a���Dk#A��1�z��s����UQ�-��(mU/�������J���^�Qò�7+�<�jČ�'���nT����r���c �nK�G���珑���E��w`[�U�&��0r�����������Y3w���*����ѷ�������e]Ӑ��[I�K���!�8+Y�/�u��[����=����|Z�F�5X��1-B\?G��)����Y(N���辫��z��u�#�7s%w9$���d�fl�U����-�=�5�������Ko��̞�e�+�� W�V1H���wj�2u|�s�&`��B��a7>���f������CY���C*����!s��=�2�����@���M6n57���66G�N��\�d&�ơ����]��DW���E���W��ݖ�FgeDԩǯ�P����GV������se&�hِ9}��w�Ҡ)��eB4�"7q�+DP+���p�^�Н� ����۬&d�$ �2��C������ ba�iw����쩞�v>��#�C�"���9i*Gfl0�"ɓ��o1Y���Sc@�Ms��%�|�iU�b��E�%���J� j�(��ta��u(l�� ���7��Tv�6�i��TP���.蓽k�&��Th��/h?H�@!!jW v���s����YY���Z�P�Dž��'���-tRG��F���P��L:��W������������MŭdG����E�1>�1[���l�{E�^�J������EC{Z�-�+����:R Γ��-4|Yo��nt�}�Y��GB� �*�'�3�/i���������R9��P@e?�n N ^@C� o��G*d�7,FŒ��o��\��[<s �s�/�Փ�������z���`t<Gɮ�s�Z��lk�`��V�?�.)��9����C��C̑R9��6�y�_�v�_���l:d,~]%�F�����R���E��+Ĺ�t����)i�����]��}�@���N��=@�[:��[":~��G��ѭ;ޥh���x�����#�9�@+��*����𣠟����qqz9�I��{�[����A�����BV1.��w��xL%;Y��#>Gg:��P�nJT�b'k����Y��N��Z%�����ɋ�^�, ,�����x�����ř�=�C[gr�u-n���g���v��-�i��9t*b��i�H�=|^.�~��\K����SD�G�2�3��ߏY�����60'?��u���U�� ��5�cG9pt���Y%/5< t��Kiv�eačk?-�훰�e���/��|b?f�ߞ��p���O�N���h�$����ᫎ�0C�]�R��#��:��k�,���?�5�|�L<\UoѪ��i��'&V��5��JR�_v���c��3�5D������x����?ɧ�����f8A�pr� ]9?(����lx�Ւ�i���U���HN!��q�ک�����Ow�KG���.�@GǦ��t !�s�y������N�����:�N���K&�k��F����>_)a��\�(&���+J�N�I�2wgi��;5��=��ּT��<5�O�ր%Z��[����A��%,Ԋ�`�_�J����@4y��W� ��8#l�x��' *��4w�v<��X��������QA";�\8���B�{��):�Q� ��k�uS�F��W\+�c7~M v��?R��� ������?��ܷ{"�F��"��6�G�?(z����-���;=� P��CԨ�A�%�O�x�Qr�y�2q����Pʞ�H���a���\/��dK��z �`���/)���)����)�煞�E�\�#�ݖ�-yg�^^ �D ����b(A�"��ӵ��{�L2D4RͭPGl�f:Uy/��k'�z2$��X-��2���/■���s��`�I0�{G/ڮBØ�f32P��o{0�c~�I5��הҀ� ��ݑ�4�9n9s&�|ӌi�?R�S�_����DŽ�3yˬ�e ZȽ>���ݲ�����@�4��̺��r���u3ᓙ]�>����/^G�<�m�lg��x�ɿ�k�k���Q�.�˝1�`��ٓ��0����� �lp ��K��L+���O�u����I���+���1h��6���Fư%B����� �W�7!��"p��V�@���}#���4�cdԮ8�f���R{8��l�3.? ����<Ӥl����!���5c�>�=����֗�i�t�H|�� -���]�B���H�K\q!���x��l��٭���l��Ԙk'C��ED�z�}P�u*ccC��y'�����f�#T,� H#/�hi=|�}����.���"5��>Qh��`�k�YxJ��-LU�̾`��pϴ�����b�?�7�'Ԉ�K ��Q��ɾoz!�#(�7���y�*�a�x
Static task
static1
Behavioral task
behavioral1
Sample
Blackberry Unlocker V1.7.1 PASS deblokgsm/BBCalculator.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral2
Sample
Blackberry Unlocker V1.7.1 PASS deblokgsm/BBCalculator.exe
Resource
win11-20240709-en
Behavioral task
behavioral3
Sample
Blackberry Unlocker V1.7.1 PASS deblokgsm/DeblokGsm.url
Resource
win10v2004-20240709-en
Behavioral task
behavioral4
Sample
Blackberry Unlocker V1.7.1 PASS deblokgsm/DeblokGsm.url
Resource
win11-20240709-en
Behavioral task
behavioral5
Sample
Blackberry Unlocker V1.7.1 PASS deblokgsm/Lire un mep Blackberry.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral6
Sample
Blackberry Unlocker V1.7.1 PASS deblokgsm/Lire un mep Blackberry.exe
Resource
win11-20240709-en
General
-
Target
Blackberry Unlocker V1.7.1 PASS deblokgsm.rar
-
Size
7.1MB
-
MD5
395615fbe6f9556f1e1560974bea83e6
-
SHA1
67fd9b0d546911cff9ff666ebe4d25310db35735
-
SHA256
85118e3afce7ccd8bca74cf3e27b4c3911d8437c0baa4249b006c992f206f275
-
SHA512
c469aae98793a030891681dc5afca92b6d878e89aafaac225e505ba72369ef657e7b579e3f4682b287a879fcb5768c46058faab11c289312c46250db7e18ed7c
-
SSDEEP
98304:p8mt0COvt+DWrzviGMioumF3klgfzTFq8WpTq4c0vt/3I4ftilLMMhT7TPV8TVkL:pJLOvt9zZMNUufvFqNFqcF/Y6UT7Ogf
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Blackberry Unlocker V1.7.1 PASS deblokgsm/BBCalculator.exe unpack001/Blackberry Unlocker V1.7.1 PASS deblokgsm/Lire un mep Blackberry.exe
Files
-
Blackberry Unlocker V1.7.1 PASS deblokgsm.rar.rar
Password: deblokgsm
-
Blackberry Unlocker V1.7.1 PASS deblokgsm/A lire.txt
-
Blackberry Unlocker V1.7.1 PASS deblokgsm/BBCalculator.exe.exe windows:5 windows x86 arch:x86
Password: deblokgsm
2efef7a664a2c02e987e53e46586569b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
VariantCopyInd
advapi32
RegSetValueExA
user32
DrawIcon
kernel32
GetVersionExW
GetVersion
GetVersionExW
GetVersionExA
GetVersion
WriteConsoleA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
msimg32
AlphaBlend
gdi32
CreateEnhMetaFileW
version
VerQueryValueW
mpr
WNetCloseEnum
ole32
OleSetMenuDescriptor
comctl32
FlatSB_SetScrollPos
shell32
SHFileOperationW
comdlg32
GetSaveFileNameW
winspool.drv
EnumPrintersW
winmm
timeGetTime
setupapi
SetupDiGetDeviceInterfaceDetailA
Exports
Exports
Sections
.text Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 142KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 671KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didata Size: - Virtual size: 934B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 112B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 7.3MB - Virtual size: 7.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 365KB - Virtual size: 365KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Blackberry Unlocker V1.7.1 PASS deblokgsm/DeblokGsm.url
-
Blackberry Unlocker V1.7.1 PASS deblokgsm/Lire un mep Blackberry.exe.exe windows:4 windows x86 arch:x86
Password: deblokgsm
dbece561706a9a391870b95992e79cff
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateEventA
GetModuleHandleA
SetEvent
ResetEvent
TerminateThread
CreateThread
GetCurrentDirectoryA
ExitProcess
WaitForSingleObject
GetComputerNameA
CreateFileA
Sleep
WriteFile
ReadFile
CloseHandle
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
SetFilePointer
FlushFileBuffers
GetLastError
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
RtlUnwind
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
SetStdHandle
HeapReAlloc
HeapFree
HeapAlloc
GetStartupInfoA
GetCommandLineA
GetVersion
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
user32
GetDlgItemTextA
DispatchMessageA
TranslateMessage
GetMessageA
SendMessageA
LoadImageA
GetSystemMetrics
CreateDialogParamA
MessageBoxA
TranslateAcceleratorA
SetDlgItemTextA
shell32
ShellExecuteA
setupapi
SetupDiGetClassDevsA
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
ws2_32
htons
socket
connect
closesocket
send
gethostbyname
inet_addr
recv
WSAStartup
Sections
.text Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 52KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Blackberry Unlocker V1.7.1 PASS deblokgsm/autoprd.db