D:\VITAL SERVICES FOLDER\ROBLOX RESELL\Morphine\Morphine\Ruin.Vip\build\Vital.pdb
Static task
static1
Behavioral task
behavioral1
Sample
Bluehub.exe
Resource
win11-20240802-en
General
-
Target
Bluehub.exe
-
Size
1.8MB
-
MD5
da8fd8fee46a2ddb4c8392c560bea108
-
SHA1
77cd1d5c8c9d5daac0599f58a84ed1031ed96783
-
SHA256
5e9ae8c349c3897b9b362b585f4447c2e315fb6400849b7b9499719b7990bf98
-
SHA512
cad082b71546e038cff7933e02d0ba6c554af7352ae492d80fd399fe965f42a66df96fe371b7bd116e80a0f31fefa1d67d1ef8494c6d07dff3a6546907eba402
-
SSDEEP
49152:jjwuCMXAn7e2TX5DyymXgXpnFfnmpSwywZnJ:3g/z5uyGD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Bluehub.exe
Files
-
Bluehub.exe.exe windows:6 windows x64 arch:x64
8628138907e696e524aa7217467d98eb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
Process32First
CreateFileW
CreateToolhelp32Snapshot
CreateFileA
Process32Next
lstrcmpiA
TerminateThread
TerminateProcess
ResumeThread
RaiseException
CreateThread
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetLocaleInfoA
QueryPerformanceFrequency
VerSetConditionMask
FreeLibrary
QueryPerformanceCounter
GetFileSizeEx
ReadFile
HeapAlloc
HeapFree
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
VirtualAlloc
GetFileInformationByHandleEx
DeviceIoControl
GetSystemInfo
AreFileApisANSI
SetFileInformationByHandle
GetFullPathNameW
GetFileAttributesExW
GetFileAttributesW
FindNextFileW
FindFirstFileExW
FindFirstFileW
FindClose
CreateDirectoryW
GetLocaleInfoEx
FormatMessageA
LocalFree
GetSystemTimeAsFileTime
GetCurrentThreadId
GetModuleHandleW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetLastError
CloseHandle
LoadLibraryA
GetCurrentProcess
SetLastError
VirtualFree
GetConsoleWindow
Sleep
GetModuleHandleA
GetVolumeInformationA
SetConsoleWindowInfo
GetStdHandle
OpenProcess
GetCurrentProcessId
GetProcAddress
GetTempPathW
LoadLibraryExA
SetConsoleScreenBufferSize
SetConsoleTitleA
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
user32
RegisterClassExA
ShowWindow
SetWindowDisplayAffinity
GetMonitorInfoA
MoveWindow
DestroyWindow
DispatchMessageA
UpdateWindow
GetKeyState
GetMessageExtraInfo
LoadCursorA
MonitorFromWindow
GetCapture
ClientToScreen
TrackMouseEvent
GetKeyboardLayout
SetCapture
SetCursor
GetClientRect
SetWindowLongPtrA
SetLayeredWindowAttributes
DefWindowProcA
GetWindowLongA
SetWindowLongA
GetSystemMetrics
CreateWindowExA
TranslateMessage
LoadIconA
PeekMessageA
UnregisterClassA
PostQuitMessage
GetDesktopWindow
SetWindowPos
GetWindowRect
MessageBoxA
FindWindowA
SendInput
GetCursorPos
GetAsyncKeyState
ScreenToClient
GetForegroundWindow
SetProcessDPIAware
IsWindowUnicode
ReleaseCapture
SetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
GetWindowThreadProcessId
GetWindowTextA
EnumWindows
gdi32
CreateSolidBrush
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
OpenProcessToken
RegSetValueExA
AdjustTokenPrivileges
LookupPrivilegeValueW
RegCreateKeyA
shell32
SHGetFolderPathW
ShellExecuteA
msvcp140
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
_Query_perf_frequency
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Winerror_map@std@@YAHH@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Random_device@std@@YAIXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_sleep
_Query_perf_counter
_Xtime_get_ticks
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
_Thrd_id
_Thrd_join
_Thrd_detach
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_init_in_situ
_Mtx_unlock
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
_Strxfrm
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$collate@D@std@@2V0locale@2@A
_Strcoll
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??Bios_base@std@@QEBA_NXZ
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
ntdll
RtlInitAnsiString
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
NtQuerySystemInformation
RtlAnsiStringToUnicodeString
dbghelp
ImageDirectoryEntryToData
ImageRvaToVa
ImageNtHeader
d3d11
D3D11CreateDeviceAndSwapChain
imm32
ImmSetCandidateWindow
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
d3dcompiler_43
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
bcrypt
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptGenRandom
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcmp
__std_type_info_compare
__std_type_info_name
_CxxThrowException
__current_exception
__current_exception_context
__intrinsic_setjmp
__std_exception_destroy
__std_exception_copy
memset
memmove
memcpy
longjmp
strrchr
strstr
strchr
__C_specific_handler
__std_terminate
_purecall
memchr
api-ms-win-crt-stdio-l1-1-0
fopen_s
fgets
_lseek
fwrite
_fileno
feof
fread
fclose
clearerr
_write
_read
fputc
_set_fmode
__stdio_common_vsscanf
_wfopen
fgetc
fseek
__stdio_common_vfprintf
_setmode
fflush
__acrt_iob_func
_sopen_s
ferror
ftell
_get_stream_buffer_pointers
__p__commode
_fseeki64
fsetpos
ungetc
_close
setvbuf
fgetpos
__stdio_common_vsprintf
api-ms-win-crt-heap-l1-1-0
_set_new_mode
_callnewh
_aligned_free
malloc
free
realloc
_aligned_malloc
api-ms-win-crt-math-l1-1-0
sqrtf
ceilf
atan2f
cosf
powf
_dclass
_dtest
sin
fmod
cos
__setusermatherr
_dsign
fmodf
sinf
acosf
api-ms-win-crt-convert-l1-1-0
strtoull
strtoul
strtol
atof
strtod
strtoll
api-ms-win-crt-runtime-l1-1-0
terminate
system
exit
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
perror
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
_beginthreadex
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_errno
abort
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
_mkdir
api-ms-win-crt-locale-l1-1-0
localeconv
___lc_codepage_func
_configthreadlocale
api-ms-win-crt-time-l1-1-0
_localtime64
strftime
_time64
api-ms-win-crt-string-l1-1-0
_stricmp
strncmp
strncpy
tolower
isdigit
strcmp
strlen
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-utility-l1-1-0
_byteswap_ulong
qsort
rand
ws2_32
connect
ioctlsocket
__WSAFDIsSet
getsockname
getsockopt
ntohs
getpeername
closesocket
select
send
setsockopt
shutdown
socket
WSAStartup
WSACleanup
WSAGetLastError
WSASocketW
getaddrinfo
recv
freeaddrinfo
getnameinfo
Exports
Exports
OPENSSL_Applink
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 409KB - Virtual size: 408KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 154KB - Virtual size: 167KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ