blister | 4eef6e58d19ce0219eb4f5fd13a71cae872cbc90700f9126e6a0532974056ada

Sharing

Copy URL

Twitter E-mail

General

Target

4eef6e58d19ce0219eb4f5fd13a71cae872cbc90700f9126e6a0532974056ada
Size

461KB
MD5

11c9c2efe05258e4eb50249adea9b41c
SHA1

1a2d723a197281fd1ee98004dec73575bbdd9e2e
SHA256

4eef6e58d19ce0219eb4f5fd13a71cae872cbc90700f9126e6a0532974056ada
SHA512

b8d19f57f28b6c384ee6e5041ff558a98ff269ef5ad12fd72447734d7855f725cf727aa11345e1773d3eb580c8954fc578f8e28584877768961896e0529474c3
SSDEEP

12288:E4iklw7nyONfnRHI30RGR0/zv6Tz/QMkk60:EFJ7nyOlBkVAzyPQMs

Score

10^/10

loader blister

Malware Config

Signatures

Blister family
blister

Detect Blister loader x32 1 IoCs

loader

resource	yara_rule
sample	family_blister_x32

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4eef6e58d19ce0219eb4f5fd13a71cae872cbc90700f9126e6a0532974056ada

Files

4eef6e58d19ce0219eb4f5fd13a71cae872cbc90700f9126e6a0532974056ada
.dll regsvr32 windows:6 windows x86 arch:x86

846468bbe62d5ef6b1ad88aca372659c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

CEWMDM.pdb

Imports

msvcrt

??2@YAPAXI@Z
realloc
??3@YAXPAX@Z
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
free
wcspbrk
_wtol
_amsg_exit
_initterm
_XcptFilter
_wcsnicmp
_ftol2_sse
wcschr
wcsncmp
wcsrchr
_wtoi
_wcsicmp
_vsnwprintf
??_U@YAPAXI@Z
_purecall
??_V@YAXPAX@Z
memcpy
malloc
memset

kernel32

LocalAlloc
LocalFree
CompareStringW
WideCharToMultiByte
GetVersionExW
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
MultiByteToWideChar
lstrlenW
lstrcpyW
GetLastError
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
LoadLibraryW
GetProcAddress
GetModuleHandleW
lstrcmpiW
LeaveCriticalSection
EnterCriticalSection
HeapDestroy
CreateEventW
CloseHandle
lstrcpynW
GetModuleFileNameW
FreeLibrary
DisableThreadLibraryCalls
lstrcatW
SetFilePointer
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
WaitForSingleObject
ResetEvent
SetEvent
CreateThread
RaiseException
GetTempPathW
GetTempFileNameW
WriteFile
CreateFileW
GetProcessHeap
HeapFree
DeleteFileW
GetSystemTimeAsFileTime
GetExitCodeThread
WaitForMultipleObjects
FileTimeToSystemTime
DebugBreak
OutputDebugStringW
InterlockedExchange
Sleep
InterlockedCompareExchange
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapAlloc
GetVersionExA
DeviceIoControl
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
ReadFile
GetDiskFreeSpaceA
GlobalMemoryStatus
GetLocalTime
LoadLibraryExA
GetFileSize
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
lstrlenA
GetEnvironmentStringsW

user32

RegisterWindowMessageA
PostMessageW
LoadIconW
GetMessageW
CharNextW
CharPrevW
PostThreadMessageW
DispatchMessageW

advapi32

RegEnumKeyExW
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegQueryValueExA
RegCreateKeyExA
RegQueryValueExW
RegDeleteValueW
RegCloseKey
RegSetValueExA
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW
TraceMessage

ole32

CoInitializeEx
CLSIDFromString
PropVariantClear
CoInitialize
CoUninitialize
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree

oleaut32

SysFreeString
LoadTypeLi
RegisterTypeLi
VariantInit
SysStringLen
VarUI4FromStr
SafeArrayDestroy
SafeArrayRedim
SafeArrayCreateVector
SysAllocStringByteLen
SysAllocStringLen
VariantClear
VariantCopy
VariantChangeType
SysAllocString

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 172KB - Virtual size: 171KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 277KB - Virtual size: 277KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

846468bbe62d5ef6b1ad88aca372659c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

user32

advapi32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 172KB - Virtual size: 171KB

.data Size: 4KB - Virtual size: 5KB

.rsrc Size: 277KB - Virtual size: 277KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 172KB - Virtual size: 171KB

.data
Size: 4KB - Virtual size: 5KB

.rsrc
Size: 277KB - Virtual size: 277KB

.reloc
Size: 6KB - Virtual size: 6KB