bluescreenview-x64.zip
- SHA256 df57d4c9418dd2771035f2f7b70952caeb20d2269af683a0ab0665125c821479
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
BlueScreenView.chm
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
60 seconds
Behavioral task
behavioral2
Sample
BlueScreenView.chm
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
1 signatures
60 seconds
Behavioral task
behavioral3
Sample
BlueScreenView.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
60 seconds
Behavioral task
behavioral4
Sample
BlueScreenView.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
1 signatures
60 seconds
General
- Target bluescreenview-x64.zip
- Size 83KB
- Sample260628-ff7evsfs9k
- SHA256 df57d4c9418dd2771035f2f7b70952caeb20d2269af683a0ab0665125c821479
- MD5 e3a494133b25553b3835397c9adcc502
- SHA1 6b4484a300da934a351f2ffb8147ba5501e8ef42
- SHA512 3568d0fb1c4a92a72a2f0773aac4c2f6c54acd5068576a30834ec6260240006919edc4dc5700cd61dffcf7e3ae8bccb2e30cba8b814f76a06163270f40e07f20
- SSDEEP 1536:a6hZSji4jVS8mj3qtWJt1WrXSm/X3yD3g7yK/I8lR/2y5BGpOdE5je2J/iy1f:a6Eimp0MTN/Qg7bjl5tGpr3tiq
- TLSH T1DF83025EAFC0E4F2423CA8726B171D0E270B02DC99A70853F6117F8462569A2B77BF1D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detected Nirsoft tools 1 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule static1/unpack001/BlueScreenView.exe Nirsoft - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/BlueScreenView.exe
File Explorer
-
bluescreenview-x64.zip.zip 83KB
-
BlueScreenView.chm.chm 18KB
-
BlueScreenView.exe.exe 143KB
-
readme.txt17KB
BlueScreenView.chm
- SHA256 3b9d7f203e282c0aaa522f706308e2215786a2fb95e9ffb86e97168ffffe3009
- MD5 d130e5001531448871bb8ef10c106b25
- SHA1 708af1ee2e3151a5a3d33eb0e2da4a3b9d6bd735
- SHA512 8c9f7d4da0af80219691eacb7b9b9ad29186252654d8a3048b053e5b1e9e1f2057dd9afe805c25c261197489d112e077ab1a5662e2c87fadd355d258390db775
- SSDEEP 192:Uv7jwJIsfXss2iU7+xoA8EypaC/er8ptoFb6LdSiWMFqXNaK/doP:UjsHfzRkBpahr8ch6lqJoP
- TLSH T18F82D0D0736A531BC085873E3FEBB919A31D1A31C81CA4AA213DE59D5372A3C6B616D8
- MD5 SHA1 SHA512 SSDEEP TLSH
BlueScreenView.exe
- IMPHASH 560c2b0021e5c85591d13a11400a7794
- SHA256 09f3023554be864f31d80f2e7e7c7e824d79a69ddf84f1f02a433e85e866282c
- MD5 46a20ae8bb7cddb9a1370c640719c8da
- SHA1 48fdc6aeb8549bf58bc9205eb58dfc6549ae8f57
- SHA512 6e5ab78e99585f498e10b7bbd5c582ba286431db1d43d88f15cdd33e200714c22dcdc193e37f1a07ea01d59e76a62444df8ec61fdeb44bbb8c849936f03dcd6c
- SSDEEP 3072:jVHA9ZYTGVbtzoDHyswzyEitJYPhkll1y89TznhOnhpJ960f:4p5zYHyskpitJYoX7T
- TLSH T1CEE33A0B33F065E8E46ADAB6CD720617D7F2B8655A34830F97A0DD9A2F63710BD10726
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
61:50:e8:b7:53:f7:1d:43:6b:44:a2:b9:66:33:09:34:4b:2a:d0:fb
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL
Chains
Jan 29, 2015
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL
Subject
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Serial Number
42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Issuer
CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jun 7, 2005 - May 30, 2020
Subject
CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 10, 2010 - May 10, 2015
Subject
CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 24, 2011 - May 30, 2020
Subject
CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL
Serial Number
1a:f0:66:0e:83:7a:35:a2:cd:92:ec:61:3f:c1:5d:b8
Issuer
CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 12, 2014 - Sep 12, 2019
Minor OS version
0
Major OS version
4
Entry point
83808
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
c:\Projects\VS2005\BlueScreenView\x64\Release\BlueScreenView.pdb
msvcrt
_initterm
__wgetmainargs
_wcmdln
exit
_cexit
_exit
_c_exit
__setusermatherr
__C_specific_handler
_onexit
__dllonexit
strlen
qsort
_wcslwr
memmove
wcstoul
wcsrchr
_commode
_fmode
__set_app_type
_XcptFilter
wcscmp
malloc
_memicmp
free
modf
memcmp
??2@YAPEAX_K@Z
??3@YAXPEAX@Z
memcpy
wcslen
_wcsicmp
wcschr
_itow
_purecall
_wtoi
wcscpy
memset
wcsncat
wcscat
_snwprintf
comctl32
ord17
ImageList_AddMasked
ImageList_Create
ImageList_SetImageCount
CreateStatusWindowW
CreateToolbarEx
ImageList_ReplaceIcon
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
kernel32
GlobalFree
ReadProcessMemory
ExitProcess
GetCurrentProcessId
DeleteFileW
CreateProcessW
SetErrorMode
WaitForSingleObject
GetStdHandle
GetPrivateProfileStringW
EnumResourceNamesW
GetPrivateProfileIntW
GetCurrentProcess
OpenProcess
EnumResourceTypesW
GetStartupInfoW
GetProcAddress
WritePrivateProfileStringW
FindResourceW
GetModuleFileNameW
ReadFile
CompareFileTime
CloseHandle
GetWindowsDirectoryW
FileTimeToLocalFileTime
ExpandEnvironmentStringsW
GetFileSize
LoadLibraryW
FileTimeToSystemTime
FreeLibrary
SystemTimeToFileTime
GetDriveTypeW
GetLogicalDrives
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
CreateFileW
LoadResource
LocalFree
GlobalAlloc
MultiByteToWideChar
LoadLibraryExW
lstrlenW
lstrcpyW
GetNumberFormatW
LockResource
WideCharToMultiByte
GlobalUnlock
GetTempPathW
GetLocaleInfoW
GetDateFormatW
GlobalLock
SizeofResource
GetTempFileNameW
GetLastError
FormatMessageW
GetVersionExW
FindNextFileW
FindFirstFileW
GetModuleHandleW
SetFilePointer
GetTimeFormatW
FindClose
GetFileAttributesW
WriteFile
user32
ReleaseCapture
FillRect
SetCapture
DrawTextExW
SetWindowTextA
IsDialogMessageW
SetCursor
LoadCursorW
GetSysColorBrush
ShowWindow
ChildWindowFromPoint
DeferWindowPos
CreateWindowExW
GetMessageW
EndDialog
GetWindowRect
GetDlgItem
GetDlgItemInt
InvalidateRect
EndPaint
GetWindow
DrawFrameControl
SetWindowTextW
SetDlgItemInt
UpdateWindow
SetDlgItemTextW
BeginPaint
GetDlgItemTextW
GetClientRect
GetSystemMetrics
LoadAcceleratorsW
DefWindowProcW
SendMessageW
PostMessageW
RegisterClassW
MessageBoxW
TranslateAcceleratorW
SetMenu
SetWindowPos
GetWindowPlacement
LoadImageW
PeekMessageW
DispatchMessageW
LoadIconW
TranslateMessage
SetWindowLongW
GetWindowLongW
EndDeferWindowPos
BeginDeferWindowPos
SetFocus
EmptyClipboard
GetDC
EnableMenuItem
ReleaseDC
GetSubMenu
GetClassNameW
OpenClipboard
MoveWindow
GetMenuItemCount
CheckMenuItem
CheckMenuRadioItem
GetMenuStringW
GetCursorPos
SetClipboardData
GetSysColor
ScreenToClient
EnableWindow
MapWindowPoints
CloseClipboard
GetMenu
GetParent
LoadMenuW
ModifyMenuW
GetMenuItemInfoW
GetDlgCtrlID
DestroyMenu
DialogBoxParamW
CreateDialogParamW
EnumChildWindows
LoadStringW
DestroyWindow
GetWindowTextW
GetFocus
RegisterWindowMessageW
TrackPopupMenu
PostQuitMessage
SendDlgItemMessageW
gdi32
SetTextColor
CreateFontIndirectW
SetBkMode
DeleteObject
GetTextExtentPoint32W
GetStockObject
SetBkColor
GetDeviceCaps
PatBlt
CreateSolidBrush
SelectObject
comdlg32
FindTextW
GetOpenFileNameW
GetSaveFileNameW
advapi32
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
shell32
ShellExecuteW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
DragFinish
DragQueryFileW
DragAcceptFiles
SHGetFileInfoW
ole32
CoUninitialize
CoInitialize
Name
.text
Size
79KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=125, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=12, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=272, id=1, productName=Unmarked objects,
count=21, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=26, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
readme.txt
- SHA256 92bff76a8cbd014a8445f6f522924db7f29b2adf5bdc344ac727d1c12b10e285
- MD5 acecb7d7af592da7a843ef44b4500818
- SHA1 ce545967c347b9df89e3df9047541b97529a9507
- SHA512 b38fe08b26f2f5423483569669cba97bc7ff793239078924b69a6c670536ccd0119ae43f96a715b1ccf6465bde6f3848251780aa795a743b0d8c30f7ef5c90dd
- SSDEEP 192:klkcs+dTkUUUSJhDWbRWaTy+2KGi1ozdg5TooWQZsDEpF7ZNO30y04bS5rr5HMn0:UDdj3ol6y+2LwzNGjuDHMdrNbIP
- TLSH T1387272173F0B237642721043564E66D5B364427FA7A719327869C12C336BB2AE3F71E9
- MD5 SHA1 SHA512 SSDEEP TLSH