Behavioral task
behavioral1
Sample
bluem2_client1.exe
Resource
win7-20240903-en
General
-
Target
bluem2_client1.exe
-
Size
4.4MB
-
MD5
5d3ba365264f4bea204e11fb8c9b49be
-
SHA1
cca3a000630cf7124156702a2fb75a55b519b69c
-
SHA256
82947768035b92587f3e893d2cba03626440ee70d4b007fa73edae14ad88bada
-
SHA512
ed9864d303083c9878172aa9db74df8a93a22b1336a73d57d63e7c21f95e989482970aa8527b1df5588e54d2a109666262bc938fdc538c6976ff9ffb0267477e
-
SSDEEP
98304:BPrmHPy82r8syUEDxiVCfnIn8SV2MyVoDuR5+P6PVX7mg3gMqbMp:BPrePy0xhgn8e2MqR5gk7mg3ebMp
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bluem2_client1.exe
Files
-
bluem2_client1.exe.exe windows:5 windows x86 arch:x86
132821fb051d529d766cfc496e84006a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
GetActiveObject
advapi32
RegOpenKeyExW
user32
SetWindowTextA
kernel32
GetVersionExA
GetVersion
GetVersionExA
GetFileType
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
SetDIBColorTable
version
GetFileVersionInfoA
ole32
OleDraw
comctl32
ImageList_Draw
imm32
ImmGetCandidateListA
shell32
ShellExecuteA
winmm
timeBeginPeriod
d3d9
Direct3DCreate9
msvcrt
islower
d3dx9_43
D3DXMatrixTranslation
ws2_32
WSASetEvent
Sections
.text Size: - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 185KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 673KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 84B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UPX0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 4.3MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ