blump[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
blump.exe
Size 5.3MB
Sample260803-wds3fsxtcv
SHA256 ba27c01816d6012db4879d9a741431a82c8917e257b798fb86ef915445a3474b
MD5 b1c7e01230d07015968971912beaadb5
SHA1 d0b3178dad3a31cd6dc30100ff71f12fbe3743ed
SHA512 0f828c82d60d32afc7f09cdde866b3599ee86255e030104f125dd55984686ed740826364ecaf91474ce5acae0148b195b1d3408773dac3de065b51ec987f66fa
SSDEEP 98304:G5hveBgrljc5o/Y7mgTm05AwJHE6hMCYGlZqL9PlF:xSJIGg7PAmkPCVZqL1lF
TLSH
T14246BE42B392C1E9C1669138CA42D7A7E3323C081F2157EB36AC7E5E6F726E04E75B51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
blump.exe

File Explorer

blump.exe

.exe 5.3MB

blump.exe

IMPHASH 09c7537d90494686d4bb01da93bd271a
SHA256 ba27c01816d6012db4879d9a741431a82c8917e257b798fb86ef915445a3474b
MD5 b1c7e01230d07015968971912beaadb5
SHA1 d0b3178dad3a31cd6dc30100ff71f12fbe3743ed
SHA512 0f828c82d60d32afc7f09cdde866b3599ee86255e030104f125dd55984686ed740826364ecaf91474ce5acae0148b195b1d3408773dac3de065b51ec987f66fa
SSDEEP 98304:G5hveBgrljc5o/Y7mgTm05AwJHE6hMCYGlZqL9PlF:xSJIGg7PAmkPCVZqL1lF
TLSH
T14246BE42B392C1E9C1669138CA42D7A7E3323C081F2157EB36AC7E5E6F726E04E75B51
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1719824

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

ntdll

RtlPcToFileHeader RtlLookupFunctionEntry VerSetConditionMask RtlVirtualUnwind RtlCaptureContext RtlUnwindEx RtlUnwind

kernel32

GetProcAddress FreeLibrary QueryPerformanceCounter GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock Sleep SwitchToThread GetConsoleWindow Module32Next GetProcessId Module32First OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle lstrcmpiW SetThreadPriority GetCurrentThread ReadProcessMemory SetConsoleTextAttribute SetConsoleTitleA GetStdHandle SetConsoleMode GetModuleFileNameW GetConsoleMode QueryFullProcessImageNameW GetExitCodeProcess CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue QueryPerformanceFrequency FlsAlloc ReadConsoleW SetFilePointerEx GetFileType GetCommandLineW GetCommandLineA WriteFile ExitProcess FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError InitializeSListHead GetCurrentProcessId GetStartupInfoW IsDebuggerPresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetStringTypeW GetSystemTimeAsFileTime GetCPInfo LoadLibraryA MultiByteToWideChar GetLocaleInfoA GetModuleHandleA DecodePointer EncodePointer DeleteCriticalSection SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage SetStdHandle HeapSize WriteConsoleW FlsGetValue SetEndOfFile EnumSystemLocalesW InitializeCriticalSectionEx LeaveCriticalSection CreateProcessW WaitForSingleObject GetTimeZoneInformation GetConsoleOutputCP FlushFileBuffers EnterCriticalSection ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId ReleaseSRWLockShared AcquireSRWLockShared SleepConditionVariableSRW GetTickCount64 RaiseException IsProcessorFeaturePresent GetLastError FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW InitOnceComplete InitOnceBeginInitialize FormatMessageA WakeAllConditionVariable LocalFree GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetModuleHandleW GetFileInformationByHandleEx LCMapStringEx

user32

MessageBeep SetForegroundWindow GetCursorPos MonitorFromPoint DispatchMessageA GetWindowRect DestroyWindow SetWindowPos GetSystemMetrics SetWindowDisplayAffinity MessageBoxA DefWindowProcA CreateWindowExA SetLayeredWindowAttributes TranslateMessage PeekMessageA GetWindowLongPtrA UnregisterClassA PostQuitMessage SetWindowLongPtrA RegisterClassExA UpdateWindow GetWindowThreadProcessId IsWindow EnumWindows IsWindowVisible ShowWindow ReleaseDC FindWindowA SendInput OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetKeyState GetMessageExtraInfo LoadCursorA GetDC ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetAsyncKeyState

gdi32

GetDeviceCaps

shell32

SHGetFolderPathA ShellExecuteA ShellExecuteW

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

winmm

timeBeginPeriod PlaySoundA

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

78KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

blump.exe

d3d11

d3dx11_43

ntdll

kernel32

user32

gdi32

shell32

d3dcompiler_47

dwmapi

imm32

winmm

generic