blister | b0d501703f77b787f5220241ad67246990b897f6d89a3d88c9ecccd31e9d1303

General

Target
b0d501703f77b787f5220241ad67246990b897f6d89a3d88c9ecccd31e9d1303
Size 430KB
Sample241030-wtlnbazpdk
SHA256 b0d501703f77b787f5220241ad67246990b897f6d89a3d88c9ecccd31e9d1303
MD5 1453760be8a6bb6351af9ae448c5371c
SHA1 dd8740be7b912297b3b6ea670ae3b6dcbf7f6379
SHA512 865ea565b4370c442b326fd192fbc99821b68cbc8c427049208657d8a4406f5799ba0dfd699292acd2c1f893eb3425d1baabed54eac62b8f3b375e39ca295186
SSDEEP 12288:Ku51yhhj7B8DxdqFpS9SsHqCxvPxU3qklu7ei:Ku5o7B6I/+HfxiqX6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

loader blister

Malware Config

Signatures

Blister family
blister

Detect Blister loader x32 1 IoCs

loader

resource	yara_rule
sample	family_blister_x32

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b0d501703f77b787f5220241ad67246990b897f6d89a3d88c9ecccd31e9d1303

File Explorer

b0d501703f77b787f5220241ad67246990b897f6d89a3d88c9ecccd31e9d1303

.dll 430KB

b0d501703f77b787f5220241ad67246990b897f6d89a3d88c9ecccd31e9d1303

IMPHASH 698be5987d1c6b7cd84c55daa8c43337
SHA256 b0d501703f77b787f5220241ad67246990b897f6d89a3d88c9ecccd31e9d1303
MD5 1453760be8a6bb6351af9ae448c5371c
SHA1 dd8740be7b912297b3b6ea670ae3b6dcbf7f6379
SHA512 865ea565b4370c442b326fd192fbc99821b68cbc8c427049208657d8a4406f5799ba0dfd699292acd2c1f893eb3425d1baabed54eac62b8f3b375e39ca295186
SSDEEP 12288:Ku51yhhj7B8DxdqFpS9SsHqCxvPxU3qklu7ei:Ku5o7B6I/+HfxiqX6
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:6 windows x86 arch:x86

Detect Blister loader x32

loader
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

73244

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

VIDRESZR.pdb

msvcrt

??2@YAPAXI@Z memset _amsg_exit _initterm malloc _XcptFilter ??3@YAXPAX@Z _vsnwprintf perror free _ftol2_sse _except_handler4_common _purecall memcpy _ftol _ftol2

mfplat

MFHeapAlloc MFTRegister MFTUnregister MFHeapFree

kernel32

SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess GetSystemTimeAsFileTime GetTickCount InterlockedDecrement QueryPerformanceCounter InitializeCriticalSection LeaveCriticalSection GetProcAddress EnterCriticalSection LoadLibraryExA DeleteCriticalSection WaitForSingleObject SetEvent CloseHandle GetCurrentThread SetThreadPriority CreateEventW GetSystemInfo GetThreadPriority CreateThread DelayLoadFailureHook GetLastError FreeLibrary InterlockedCompareExchange InterlockedIncrement GetModuleFileNameA InterlockedExchange Sleep GetCurrentProcessId GetCurrentThreadId

ole32

CoTaskMemFree PropVariantClear CoTaskMemAlloc

oleaut32

SysAllocString SysFreeString

advapi32

EventWrite EventUnregister EventRegister RegSetValueA RegSetValueExA RegCreateKeyW RegCloseKey RegOpenKeyExW RegQueryValueExW

msdmo

DMORegister MoInitMediaType MoCopyMediaType DMOUnregister MoFreeMediaType

Name

.text

Size

119KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

RT_CODE

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

RT_DATA

Size

1024B

Virtual Size

944B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

281KB

Virtual Size

280KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

b0d501703f77b787f5220241ad67246990b897f6d89a3d88c9ecccd31e9d1303

msvcrt

mfplat

kernel32

ole32

oleaut32

advapi32

msdmo

generic