Blaze[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Blaze.exe
Size 220KB
Sample260709-e1s8ascw5m
SHA256 713aa6d48b6eba51a53ae3cd5aa387955047b415468379dd1313ac1291c1915d
MD5 55d11b98d6b4025f9df3a84dda9b7b8b
SHA1 0af37e3c88dedcec100d15a63435bd4af4518701
SHA512 f71308d15f7fedb12f15d55cc233eff67c3cb1a8faa54ce28e881b6de90d4edac7ae70702c6bc13a42469a52fc71d5566cbbd382bb0285bf033842d89f7f7ba7
SSDEEP 6144:cioJH1dwy5NMeiWWBzhcYQI2+z98OWpNr:iJHlWWYzmYO+5w
TLSH
T1ED245B679B61BCC2CB864276D8B95D880FAAD731414592CEE0AF8101CE477F6EE4E43D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Blaze.exe

File Explorer

Blaze.exe

.exe 220KB

Blaze.exe

IMPHASH 38c46fc9afc84d26aca8322b28c11e9c
SHA256 713aa6d48b6eba51a53ae3cd5aa387955047b415468379dd1313ac1291c1915d
MD5 55d11b98d6b4025f9df3a84dda9b7b8b
SHA1 0af37e3c88dedcec100d15a63435bd4af4518701
SHA512 f71308d15f7fedb12f15d55cc233eff67c3cb1a8faa54ce28e881b6de90d4edac7ae70702c6bc13a42469a52fc71d5566cbbd382bb0285bf033842d89f7f7ba7
SSDEEP 6144:cioJH1dwy5NMeiWWBzhcYQI2+z98OWpNr:iJHlWWYzmYO+5w
TLSH
T1ED245B679B61BCC2CB864276D8B95D880FAAD731414592CEE0AF8101CE477F6EE4E43D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

22704

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?good@ios_base@std@@QEBA_NXZ ?uncaught_exceptions@std@@YAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

rpcrt4

UuidFromStringA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset __current_exception_context __std_exception_destroy __std_terminate memcpy memcmp __std_exception_copy __C_specific_handler _CxxThrowException __current_exception

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function terminate _initialize_onexit_table _crt_atexit _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _set_app_type _seh_filter_exe

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc _callnewh free

kernel32

RtlCaptureContext GetModuleHandleW InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry IsDebuggerPresent