Bloxshade[.]zip | Triage™

Resubmissions

05/08/2024, 12:06

240805-n985jsyhme1

05/08/2024, 12:06

05/08/2024, 12:04

05/08/2024, 12:03

05/08/2024, 12:01

05/08/2024, 12:01

Sharing

Copy URL Twitter E-mail

General

Target
Bloxshade.zip
Size 3.9MB
Sample240805-n698faygpg
SHA256 03539a59a60c0124a8bf28736ff945f96a5494d907b4bafa4edeca118410750e
MD5 068931213e7386d31e4477e7432f37c9
SHA1 1f5cf480d9a9578418f590523228a7ec6272a12f
SHA512 93c63b658445348133adf2d8e7bdf280e8f881664ed73175ee7fb49e40dc28ac62990bcc7baad89e644f5fde95eb601bf0fb32f267c39b96e48dded654aecea7
SSDEEP 98304:ZHRWtoWNo0bRZEhIj0DagrGGhCSFq1PUlwZEHGYMlfQ5:ZHRoi0bRiG0BaSFq1PUlQYMa5
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

Bloxshade.zip

.zip .ps1 3.9MB
Setup - Bloxshade.exe

.exe 9.2MB

Bloxshade.zip

SHA256 03539a59a60c0124a8bf28736ff945f96a5494d907b4bafa4edeca118410750e
MD5 068931213e7386d31e4477e7432f37c9
SHA1 1f5cf480d9a9578418f590523228a7ec6272a12f
SHA512 93c63b658445348133adf2d8e7bdf280e8f881664ed73175ee7fb49e40dc28ac62990bcc7baad89e644f5fde95eb601bf0fb32f267c39b96e48dded654aecea7
SSDEEP 98304:ZHRWtoWNo0bRZEhIj0DagrGGhCSFq1PUlwZEHGYMlfQ5:ZHRoi0bRiG0BaSFq1PUlQYMa5
MD5 SHA1 SHA512 SSDEEP

polyglot

Password

Maisam20211

Setup - Bloxshade.exe

IMPHASH 592e7a98c75be05ccbff9d8b89249253
SHA256 4b78c95b9a8e9f7e0934cce997b176f85dcb4a662bf134bdb3ce89f3ae47288b
MD5 dfbe896ade6ae361efd045187b9ae9f3
SHA1 a5321f14809ddb9d2663685e63d4bfafb00a9f4a
SHA512 ff66de45f95b3782df9c3471dd7a8cc1701d9e4de5d8a991e1d7503da15d8bae8322b131b7f8fe1455678a40759b17b1ee9f011629b074dca07b588f1817faa3
SSDEEP 98304:soXaczi2BKW2oqTqYhLsj4xTdhblvVXn9SXm90hSJ:soX3bqTnLsj4xbbl9X9sg0hy
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Password

Maisam20211

PE Signature issue

Digest

1e:7d:26:e6:49:52:0e:80:25:dc:1e:34:67:1d:3e:6b:96:78:ec:d9

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Extravi,O=extravi.dev,1.2.840.113549.1.9.1=#0c1164616e746540657874726176692e646576

Chains

Aug 5, 2024

Minor OS version

Major OS version

Entry point

299952

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\hecker\Desktop\Bloxshade-main\bloxshade\build\start.pdb

kernel32

LockResource CloseHandle LoadResource FindResourceW FreeResource WinExec SetEndOfFile SetStdHandle SetEnvironmentVariableW WaitForSingleObject CreateProcessW SizeofResource FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetLastError GetModuleHandleW GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleFileNameW GetModuleHandleExW HeapAlloc HeapSize HeapValidate GetSystemInfo ExitProcess GetStdHandle WriteFile GetFileType OutputDebugStringW WriteConsoleW GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapFree HeapReAlloc HeapQueryInformation GetProcessHeap ReadFile ReadConsoleW GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetCommandLineA RtlUnwind

user32

MessageBoxW

advapi32

RegOpenKeyExW RegCloseKey

shell32

ord680 ShellExecuteW