bluewingemulator[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
bluewingemulator.exe
Size 2.1MB
Sample260601-wkbrract2s
SHA256 f53c93443e54149f5d1c6be5721b8472b4799d50e9d09bb11e93cc253ab0dc99
MD5 8b8961b070ba86dcff1e759232de812b
SHA1 015892ae8ba5dba46da802dcbc301aaf82cf4123
SHA512 b7c9083d4bcf0bcc466cfcd9afb45ef7411ab1394656d399bec1c06b1bc657ba773d1290dd4a7560b218ec74dca0543f5503c2a48533e3e4b24df32aeb397374
SSDEEP 49152:K++D0oSKLTmmK9lODbLcXS8Waaq59TxcrrlTl/u6iT:R+kAvi
TLSH
T179A59E0566E803F9E277D1B9C9621607E6B2B8450770AADF03E05E9A1F377A05B3F712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bluewingemulator.exe

File Explorer

bluewingemulator.exe

.exe 2.1MB

bluewingemulator.exe

IMPHASH 6a14d45da32db0182cc0117599e5357b
SHA256 f53c93443e54149f5d1c6be5721b8472b4799d50e9d09bb11e93cc253ab0dc99
MD5 8b8961b070ba86dcff1e759232de812b
SHA1 015892ae8ba5dba46da802dcbc301aaf82cf4123
SHA512 b7c9083d4bcf0bcc466cfcd9afb45ef7411ab1394656d399bec1c06b1bc657ba773d1290dd4a7560b218ec74dca0543f5503c2a48533e3e4b24df32aeb397374
SSDEEP 49152:K++D0oSKLTmmK9lODbLcXS8Waaq59TxcrrlTl/u6iT:R+kAvi
TLSH
T179A59E0566E803F9E277D1B9C9621607E6B2B8450770AADF03E05E9A1F377A05B3F712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

297056

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpQueryDataAvailable WinHttpConnect WinHttpSendRequest WinHttpAddRequestHeaders WinHttpSetOption WinHttpQueryHeaders WinHttpOpenRequest WinHttpCloseHandle WinHttpReadData WinHttpOpen WinHttpReceiveResponse

advapi32

RegisterServiceCtrlHandlerW OpenServiceW ChangeServiceConfigW StartServiceCtrlDispatcherW CloseServiceHandle OpenSCManagerW SetServiceStatus ConvertStringSecurityDescriptorToSecurityDescriptorW ControlService StartServiceW QueryServiceConfigW

kernel32

SetStdHandle HeapSize WriteConsoleW CompareStringW HeapReAlloc GetOEMCP WriteFile CreateFileW CreateFileA CloseHandle CreateThread CreateProcessW CreateDirectoryW ReadFile FindFirstFileA SetConsoleTextAttribute GetStdHandle TerminateProcess GetModuleFileNameW CreateNamedPipeW FindNextFileA CreatePipe ExpandEnvironmentStringsA FindClose WaitForSingleObject DisconnectNamedPipe OpenProcess SetFileAttributesW CreateToolhelp32Snapshot Sleep GetLastError Process32NextW DeleteFileA Process32FirstW GetCurrentProcessId CreateProcessA ConnectNamedPipe GetExitCodeProcess GetConsoleScreenBufferInfo SetConsoleTitleA GetCurrentProcess GetFileAttributesW GetCurrentThreadId FreeConsole GetLocalTime GetThreadContext GetProcAddress GlobalLock ExitProcess GetModuleHandleW GetConsoleWindow SetConsoleCursorPosition GetTickCount GlobalUnlock AllocConsole SetEndOfFile IsDebuggerPresent CheckRemoteDebuggerPresent MultiByteToWideChar QueryPerformanceFrequency FreeLibrary QueryPerformanceCounter LoadLibraryExW VirtualProtect GetFileType HeapAlloc HeapFree UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent GetConsoleCP GetModuleHandleExW FreeLibraryAndExitThread ExitThread FlsFree FlsSetValue FlsGetValue LCMapStringW FlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection WakeAllConditionVariable GetACP GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW IsValidCodePage PeekConsoleInputA ReadConsoleInputW GetNumberOfConsoleInputEvents SetConsoleMode ReadConsoleW GetFileAttributesExW GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation SetFilePointerEx GetFileSizeEx GetCommandLineW GetCommandLineA FindNextFileW WideCharToMultiByte FindFirstFileExW OpenThread RtlUnwind EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW ReleaseSRWLockExclusive AcquireSRWLockExclusive GetSystemTimePreciseAsFileTime SleepConditionVariableSRW

user32

GetSystemMenu DeleteMenu OpenClipboard GetClipboardData EnumDisplayDevicesA CloseClipboard

bcrypt

BCryptOpenAlgorithmProvider BCryptDecrypt BCryptGetProperty BCryptDestroyKey BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptSetProperty BCryptFinishHash BCryptCreateHash BCryptGenerateSymmetricKey BCryptGenRandom BCryptEncrypt

Name

.text

Size

479KB

Virtual Size

478KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

160KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

27KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

bluewingemulator.exe

winhttp

advapi32

kernel32

user32

bcrypt

generic