BlurAutoClicker[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
BlurAutoClicker.exe
Size 16.3MB
Sample260715-mn8ffsdw6x
SHA256 18e6f97db8b3d76c2bd0ce98764975278c9c78da70e718b9e1cd8b9db0a3dbc4
MD5 d1bafd02a470c852254ec6b578633b0a
SHA1 59f058b454665b41e397f61d589a1363c2cc5be0
SHA512 36b203fdc9a462e2761ac334443775ef0732c02c933a569f271eef616aef8011cb96b796fc8d744c56327f6e6513254ffa8e0d4c19ebc6a95e8bf14f6c1e0613
SSDEEP 196608:R/+1BnYR3UH64FPcYmCoFeUihlWQlwxQzqM/J:RW1BnYR3bQlE8
TLSH
T164071B11BA5B95ACD1DAC8F4C34686774D6134EB0A36B8AF41C461F83F6EFE05B28319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BlurAutoClicker.exe

File Explorer

BlurAutoClicker.exe

.exe 16.3MB

BlurAutoClicker.exe

IMPHASH 7259e79c6371ec4132b23f486342c6e8
SHA256 18e6f97db8b3d76c2bd0ce98764975278c9c78da70e718b9e1cd8b9db0a3dbc4
MD5 d1bafd02a470c852254ec6b578633b0a
SHA1 59f058b454665b41e397f61d589a1363c2cc5be0
SHA512 36b203fdc9a462e2761ac334443775ef0732c02c933a569f271eef616aef8011cb96b796fc8d744c56327f6e6513254ffa8e0d4c19ebc6a95e8bf14f6c1e0613
SSDEEP 196608:R/+1BnYR3UH64FPcYmCoFeUihlWQlwxQzqM/J:RW1BnYR3bQlE8
TLSH
T164071B11BA5B95ACD1DAC8F4C34686774D6134EB0A36B8AF41C461F83F6EFE05B28319
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12031984

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

BlurAutoClicker.pdb

bcryptprimitives

ProcessPrng

kernel32

RtlPcToFileHeader CompareStringOrdinal WaitForSingleObject SleepEx SetLastError GetFullPathNameW QueryFullProcessImageNameW SetHandleInformation RtlLookupFunctionEntry SetFileTime SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW GetCurrentProcess DuplicateHandle GetExitCodeProcess SetThreadStackGuarantee MoveFileExW FindFirstFileExW ExitProcess GetSystemInfo WideCharToMultiByte WaitForSingleObjectEx ReleaseMutex GetFinalPathNameByHandleW CreateSymbolicLinkW DeleteFileW GetModuleFileNameW MultiByteToWideChar SetWaitableTimer GetFileAttributesW GetTempPathW FindNextFileW OpenProcess FindClose FlsAlloc SwitchToThread HeapReAlloc GetModuleHandleA Sleep GetProcAddress FlsGetValue FlsSetValue LoadLibraryExA FlsFree FormatMessageW EncodePointer GetLastError InitializeSListHead RtlUnwindEx GetSystemTimeAsFileTime HeapAlloc GetCurrentProcessId SleepConditionVariableSRW LCIDToLocaleName GetSystemTimePreciseAsFileTime GetCurrentThreadId InitializeCriticalSection CloseHandle HeapFree GetProcessHeap SetUnhandledExceptionFilter SetEnvironmentVariableW GetFileType SetEvent TerminateProcess GetVersion RaiseException RemoveVectoredExceptionHandler GetLocalTime OutputDebugStringW LocalFree InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared InitOnceExecuteOnce TlsAlloc TlsGetValue TlsSetValue OutputDebugStringA LoadLibraryExW FreeLibrary GetCommandLineW GetEnvironmentVariableW LoadLibraryW GetCurrentDirectoryW WakeAllConditionVariable AddVectoredExceptionHandler CreateThread CreateToolhelp32Snapshot Process32FirstW Process32NextW SystemTimeToFileTime FreeEnvironmentStringsW GetEnvironmentStringsW RtlVirtualUnwind RtlCaptureContext QueryPerformanceCounter QueryPerformanceFrequency SystemTimeToTzSpecificLocalTime GetCurrentThread GetOverlappedResult PostQueuedCompletionStatus ReadFile WriteFile lstrlenW GetQueuedCompletionStatusEx CreateIoCompletionPort CreateNamedPipeW TransactNamedPipe CancelIoEx GetModuleHandleW InitializeCriticalSectionAndSpinCount GetUserDefaultUILanguage DeleteCriticalSection SetFilePointerEx SetNamedPipeHandleState CreateFileW SetProcessWorkingSetSize QueryThreadCycleTime SetFileCompletionNotificationModes LoadLibraryA WaitNamedPipeW ReadFileEx WriteFileEx CreateEventW CreateWaitableTimerExW GetConsoleOutputCP GetConsoleMode CreateProcessW GetStdHandle CreateDirectoryW CreateMutexA WriteConsoleW DeviceIoControl InitializeCriticalSectionEx

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW BuildExplicitAccessWithNameW BuildSecurityDescriptorW RegQueryValueExW RegOpenKeyExW EventUnregister SystemFunction036 EventWriteTransfer EventSetInformation RegCloseKey EventRegister RegDeleteValueW RegSetValueExW RegGetValueW

oleaut32

SysFreeString GetErrorInfo SetErrorInfo SysStringLen

ntdll

NtWriteFile RtlGetVersion NtOpenFile RtlNtStatusToDosError NtCreateNamedPipeFile NtSetTimerResolution NtReadFile NtCancelIoFileEx NtDeviceIoControlFile NtCreateFile

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

user32

SetPropW RegisterClassExW CreateWindowExW GetKeyboardState SetWindowTextW GetWindowTextLengthW GetMenu MapVirtualKeyExW GetKeyboardLayout ToUnicodeEx GetSystemMenu ClipCursor GetClipCursor ShowCursor MsgWaitForMultipleObjectsEx GetParent RegisterClassW ChangeWindowMessageFilterEx KillTimer SetTimer GetWindow SetFocus SetParent DestroyMenu RemoveMenu CreateIcon EnableMenuItem CheckMenuItem CreatePopupMenu RegisterWindowMessageA SetMenu DrawMenuBar SetMenuItemInfoW AppendMenuW InsertMenuW SystemParametersInfoA IsProcessDPIAware GetDC TrackPopupMenu PostQuitMessage DrawTextW ReleaseDC GetWindowDC OffsetRect FindWindowExW GetMenuBarInfo VkKeyScanW CreateAcceleratorTableW DestroyAcceleratorTable SetWindowPos GetKeyState GetWindowTextW GetWindowThreadProcessId GetDoubleClickTime GetClassNameW GetMessageA SetWindowLongW MessageBoxW CallNextHookEx TranslateAcceleratorW CreateMenu EnumWindows AdjustWindowRect GetMenuItemInfoW GetClientRect SetWindowRgn GetForegroundWindow RegisterRawInputDevices DestroyIcon SetWindowDisplayAffinity SendInput SetForegroundWindow RegisterTouchWindow IsWindow AdjustWindowRectEx FlashWindowEx GetActiveWindow UpdateWindow InvalidateRect SetCursorPos DrawIconEx InvalidateRgn GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW GetWindowRect GetUpdateRect MapVirtualKeyW ValidateRect GetRawInputData SetCursor LoadCursorW GetIconInfo CloseTouchInputHandle GetTouchInputInfo DestroyWindow TrackMouseEvent SetCapture SystemParametersInfoW ReleaseCapture FillRect GetSystemMetrics GetMonitorInfoW MonitorFromRect ClientToScreen GetWindowLongW ScreenToClient GetWindowLongPtrW DefWindowProcW SetWindowLongPtrW PostThreadMessageW PostMessageW DispatchMessageW GetAsyncKeyState WaitMessage PeekMessageW UnhookWindowsHookEx GetMessageW SetWindowsHookExW ShowWindow MapWindowPoints IsWindowEnabled MonitorFromPoint EnumDisplayMonitors MonitorFromWindow IsIconic IsWindowVisible EnableWindow RedrawWindow GetCursorPos SendMessageW EnumChildWindows DispatchMessageA TranslateMessage

shell32

ExtractIconExW ILCreateFromPathW SHOpenFolderAndSelectItems ShellExecuteExW Shell_NotifyIconW SHAppBarMessage ILFree SHCreateItemFromParsingName SHGetKnownFolderPath DragQueryFileW Shell_NotifyIconGetRect DragFinish ShellExecuteW

gdi32

SetTextColor CreateRectRgn GetDeviceCaps CreateSolidBrush SetBkMode DeleteDC BitBlt DeleteObject CombineRgn SelectObject CreateDIBSection CreateCompatibleDC GetObjectW

comctl32

RemoveWindowSubclass TaskDialogIndirect SetWindowSubclass DefSubclassProc

ole32

CoInitialize CoInitializeEx CoTaskMemFree RegisterDragDrop CoCreateFreeThreadedMarshaler CoUninitialize RevokeDragDrop OleInitialize CoCreateInstance CoTaskMemAlloc

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow DwmGetWindowAttribute

shlwapi

SHCreateMemStream

bcrypt

BCryptGenRandom

ws2_32

freeaddrinfo getaddrinfo WSACleanup WSAStartup WSASocketW ioctlsocket bind setsockopt closesocket getsockopt WSAGetLastError shutdown getsockname getpeername connect WSAIoctl send WSASend recv

crypt32

CertSetCertificateContextProperty CertFreeCertificateContext CertAddEncodedCertificateToStore CertFreeCertificateChain CertCloseStore CertFreeCertificateChainEngine CertVerifyCertificateChainPolicy CertCreateCertificateChainEngine CertGetCertificateChain CertOpenStore

api-ms-win-crt-math-l1-1-0

floor __setusermatherr cos round trunc log sin log2 _hypot pow roundf

api-ms-win-crt-string-l1-1-0

_wcsicmp strlen wcslen strcmp wcscmp strcpy_s

api-ms-win-crt-heap-l1-1-0

_callnewh realloc calloc free malloc _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_wassert _invoke_watson _initialize_narrow_environment signal _initterm_e abort _get_initial_narrow_environment _configure_narrow_argv _exit __p___argc __p___argv _cexit _set_app_type _c_exit exit _seh_filter_exe _register_thread_local_exe_atexit_callback _errno terminate _crt_atexit _register_onexit_function _initialize_onexit_table _initterm

api-ms-win-crt-stdio-l1-1-0

fflush __stdio_common_vsprintf_p __stdio_common_vsprintf __p__commode fseek _set_fmode __stdio_common_vfprintf fclose feof __stdio_common_vsscanf ftell fwrite _setmode fread _fileno ferror fgets __acrt_iob_func fopen fputs

api-ms-win-crt-convert-l1-1-0

wcstol _wtoi strtol _ultow_s

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-utility-l1-1-0

bsearch

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

msvcp140

?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1ios_base@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ??0ios_base@std@@IEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?good@ios_base@std@@QEBA_NXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ