Bluecoin2-17-1-0-Windows64[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
Bluecoin2-17-1-0-Windows64.zip
Size 24.7MB
Sample260910-wfhphatbrg
SHA256 736370e956ea877a18e429b0dbe917c9433f12baa7a7bd34a8fadc0adddca3d8
MD5 970db151cdd13c7bf5744156079e935b
SHA1 4185af256fc7ad35c03c060ea2e58f322cd9ef53
SHA512 39e7540803227c89f98db722105fe4308e5ad8ae2fd2d4362438cd775e5b766797de490cb8f97504bea245c46bebdb616d8c38f62ac0dc0ae2fbc729c785292f
SSDEEP 786432:QvSb2EOq9S5niNX/jBq0uPGwc48u5ly3N+5GQCrPF0zXg7JPR:Qv0xOgS5niMxPwBu5lgNQGNEgFPR
TLSH
T1B54733DBF5818F6A450FDA22E24B1D90CEEFB429DE2E083C354649C2C5C7ED651A8B4D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/bluecoin-cli.exe
unpack001/bluecoin-qt.exe
unpack001/bluecoin-tx.exe
unpack001/bluecoind.exe

File Explorer

Bluecoin2-17-1-0-Windows64.zip

.zip 24.7MB
bluecoin-cli.exe

.exe 5.4MB
bluecoin-qt.exe

.exe 48.1MB
bluecoin-tx.exe

.exe 6.0MB
bluecoind.exe

.exe 16.9MB

Bluecoin2-17-1-0-Windows64.zip

SHA256 736370e956ea877a18e429b0dbe917c9433f12baa7a7bd34a8fadc0adddca3d8
MD5 970db151cdd13c7bf5744156079e935b
SHA1 4185af256fc7ad35c03c060ea2e58f322cd9ef53
SHA512 39e7540803227c89f98db722105fe4308e5ad8ae2fd2d4362438cd775e5b766797de490cb8f97504bea245c46bebdb616d8c38f62ac0dc0ae2fbc729c785292f
SSDEEP 786432:QvSb2EOq9S5niNX/jBq0uPGwc48u5ly3N+5GQCrPF0zXg7JPR:Qv0xOgS5niMxPwBu5lgNQGNEgFPR
TLSH
T1B54733DBF5818F6A450FDA22E24B1D90CEEFB429DE2E083C354649C2C5C7ED651A8B4D
MD5 SHA1 SHA512 SSDEEP TLSH

bluecoin-cli.exe

IMPHASH 5b836dd5e40a11cf683ce93c6403ab88
SHA256 0b8d83e3478ebb5638da82f3cab66c4a2b4dc7259a32f0cfa180e5fc6647b3ce
MD5 e30d0e1938dfd73ff134d6094804a9fa
SHA1 08a586d138ffbccb033344821eed261cfc7e912a
SHA512 0dab071764ca8aecfa583b912fb0a5b3a0bd64603da19f19f36718799620743d2ed185c5674fa8345ca35eea2b8c71eb40a7f1a61d742e6588077db28b962873
SSDEEP 98304:JquHArmQMVPiUlMgawhN0fqkbM0QIJoK9KKHrSyZik4rHt//aF3wooAmxgMgjjxf:kzmigaIu3
TLSH
T12D464B43AA875CEECDD753B452D36336A774FC648B36AF2B6504D6351D12BC0AA2BB00
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5376

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

CryptAcquireContextA CryptAcquireContextW CryptGenRandom CryptReleaseContext DeregisterEventSource InitializeSecurityDescriptor RegCloseKey RegQueryValueExA RegisterEventSourceW ReportEventW SetSecurityDescriptorDacl

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateDCW DeleteDC DeleteObject GetBitmapBits GetDeviceCaps GetObjectW SelectObject

kernel32

AddVectoredExceptionHandler AreFileApisANSI CloseHandle CopyFileW CreateDirectoryExW CreateDirectoryW CreateEventA CreateFileA CreateFileMappingA CreateFileW CreateIoCompletionPort CreateSemaphoreA CreateWaitableTimerA DeleteCriticalSection DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection FindClose FindFirstFileW FindNextFileW FlushFileBuffers FormatMessageA FormatMessageW FreeLibrary GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetEnvironmentVariableW GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileTime GetFileType GetFullPathNameW GetHandleInformation GetLastError GetLogicalProcessorInformation GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessAffinityMask GetProcessHeap GetQueuedCompletionStatus GetStartupInfoA GetStdHandle GetSystemDirectoryA GetSystemInfo GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount GetTimeZoneInformation GetVersion GetVersionExW GetWindowsDirectoryW GlobalMemoryStatus HeapAlloc HeapFree InitializeCriticalSection InitializeCriticalSectionAndSpinCount IsDBCSLeadByteEx IsDebuggerPresent LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryW LocalAlloc LocalFree LockFileEx MapViewOfFile MoveFileExA MoveFileExW MultiByteToWideChar OpenEventA OutputDebugStringA PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSemaphore RemoveDirectoryW RemoveVectoredExceptionHandler ResetEvent ResumeThread RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetCurrentDirectoryW SetEndOfFile SetEvent SetFileAttributesW SetFilePointerEx SetFileTime SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SetWaitableTimer Sleep SuspendThread SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter UnmapViewOfFile VirtualProtect VirtualQuery WaitForMultipleObjects WaitForMultipleObjectsEx WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte __C_specific_handler

msvcrt

___lc_codepage_func __dllonexit __doserrno __getmainargs __initenv __iob_func __lconv_init __mb_cur_max __pioinfo __set_app_type __setusermatherr _acmdln _amsg_exit _beginthread _beginthreadex _cexit _chsize _close _endthreadex _errno _exit _filelengthi64 _fileno _fmode _fstat64 _get_osfhandle _getch _getpid _gmtime64 _initterm _localtime64 _lock _lseeki64 _onexit _open _read _setjmp _setmode _strdup _stricmp _strnicmp _time64 _ultoa _unlock _vscprintf _vsnprintf _wfopen _write abort atoi calloc exit fclose feof ferror fflush fgetpos fgets fopen fprintf fputc fputs fread free freopen fseek fsetpos ftell fwprintf fwrite getc getenv getwc isalnum islower isspace isupper iswctype isxdigit localeconv malloc memchr memcmp memcpy memmove memset printf putc putwc qsort raise realloc setbuf setlocale setvbuf signal sprintf sscanf strcat strchr strcmp strcoll strcpy strerror strftime strlen strncmp strncpy strpbrk strrchr strspn strstr strtol strtoul strxfrm system tolower towlower towupper ungetc ungetwc vfprintf wcscoll wcscpy wcsftime wcslen wcsstr wcstombs wcsxfrm _vsnwprintf _snwprintf longjmp _write _strdup _read _open _fileno _fdopen _close

shell32

SHGetSpecialFolderPathA

user32

GetDesktopWindow GetProcessWindowStation GetUserObjectInformationW MessageBoxW

ws2_32

WSAGetLastError WSAGetOverlappedResult WSAIoctl WSARecv WSASend WSASetLastError WSAStartup accept bind closesocket connect gethostbyname getnameinfo getpeername getprotobynumber getservbyname getsockname getsockopt htonl htons ioctlsocket listen ntohl ntohs recv select send setsockopt shutdown socket

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

348KB

Virtual Size

347KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

105KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

136KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

120B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

636KB

Virtual Size

635KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

164KB

Virtual Size

164KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

bluecoin-qt.exe

IMPHASH 8b49d8f8b44b3557170e52882fe54739
SHA256 49817bb5cc02e899e15f70613184620f28c2ac297619828b484142a51c2dced1
MD5 96512e3c75b5e64d022c580275a08645
SHA1 68c7873580c9b956acb75ded267564846a0ee47b
SHA512 45dd20f71b69ce04a9fddcc14443bf42e70afe7d7707e3a680b0cdef53a62bfb365975f3ec0f3582f5e95e36f19425d5bffce09c36cbe81f11bef09a4ae8a0fc
SSDEEP 393216:fRBVTcvOZiKyPT9TuJsv6tWKFdu9CWNgQAVL2gVG:nV4oiKyPfS9Q
TLSH
T179B77C43B6DA58ADC897D3B456D74332B7307C558636BA1B6244EB312E23BC0AF2E744
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AccessCheck AddAccessAllowedAce AllocateAndInitializeSid CopySid CryptAcquireContextA CryptAcquireContextW CryptGenRandom CryptReleaseContext DeregisterEventSource DuplicateToken FreeSid GetLengthSid GetTokenInformation InitializeAcl InitializeSecurityDescriptor MapGenericMask OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegFlushKey RegNotifyChangeKeyValue RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExA RegQueryValueExW RegSetValueExW RegisterEventSourceW ReportEventW SetSecurityDescriptorDacl SetSecurityDescriptorGroup SetSecurityDescriptorOwner

crypt32

CertCreateCertificateContext CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain

dwmapi

DwmEnableBlurBehindWindow DwmIsCompositionEnabled

gdi32

AddFontMemResourceEx AddFontResourceExW BitBlt CombineRgn CreateBitmap CreateCompatibleBitmap CreateCompatibleDC CreateDCW CreateDIBSection CreateFontIndirectW CreateRectRgn DeleteDC DeleteObject EnumFontFamiliesExW ExtTextOutW GdiFlush GetBitmapBits GetCharABCWidthsFloatW GetCharABCWidthsW GetDIBits GetDeviceCaps GetFontData GetGlyphOutlineW GetObjectW GetOutlineTextMetricsW GetRegionData GetStockObject GetTextExtentPoint32W GetTextFaceW GetTextMetricsW OffsetRgn RemoveFontMemResourceEx RemoveFontResourceExW SelectClipRgn SelectObject SetBkMode SetGraphicsMode SetTextAlign SetTextColor SetWorldTransform

imm32

ImmAssociateContext ImmGetCompositionStringW ImmGetContext ImmGetDefaultIMEWnd ImmGetVirtualKey ImmNotifyIME ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

iphlpapi

GetAdaptersAddresses GetAdaptersInfo GetBestRoute GetIpAddrTable GetNetworkParams if_indextoname if_nametoindex

kernel32

AddVectoredExceptionHandler AreFileApisANSI CancelIoEx CheckRemoteDebuggerPresent CloseHandle CompareStringW ConnectNamedPipe CopyFileW CreateDirectoryA CreateDirectoryExW CreateDirectoryW CreateEventA CreateEventW CreateFileA CreateFileMappingA CreateFileMappingW CreateFileW CreateIoCompletionPort CreateMutexW CreateNamedPipeW CreateProcessW CreateSemaphoreA CreateThread CreateWaitableTimerA DeleteCriticalSection DeleteFileA DeleteFileW DeviceIoControl DisconnectNamedPipe DuplicateHandle EnterCriticalSection ExitProcess ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindCloseChangeNotification FindFirstChangeNotificationW FindFirstFileA FindFirstFileExW FindFirstFileW FindNextChangeNotification FindNextFileA FindNextFileW FlushFileBuffers FormatMessageA FormatMessageW FreeLibrary GetCommandLineW GetConsoleWindow GetCurrencyFormatW GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDiskFreeSpaceA GetDiskFreeSpaceExW GetDriveTypeW GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileTime GetFileType GetFullPathNameW GetGeoInfoW GetHandleInformation GetLastError GetLocalTime GetLocaleInfoW GetLogicalDrives GetLogicalProcessorInformation GetLongPathNameW GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOverlappedResult GetProcAddress GetProcessAffinityMask GetProcessHeap GetProcessTimes GetQueuedCompletionStatus GetStartupInfoA GetStartupInfoW GetStdHandle GetSystemDirectoryA GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempPathA GetTempPathW GetThreadContext GetThreadId GetThreadPriority GetThreadTimes GetTickCount GetTickCount64 GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLangID GetUserGeoID GetUserPreferredUILanguages GetVersion GetVersionExA GetVersionExW GetVolumeInformationW GetVolumePathNamesForVolumeNameW GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalMemoryStatus GlobalSize GlobalUnlock HeapAlloc HeapFree InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionAndSpinCount IsDBCSLeadByteEx IsDebuggerPresent LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryW LocalAlloc LocalFree LockFile LockFileEx MapViewOfFile MoveFileA MoveFileExA MoveFileExW MoveFileW MultiByteToWideChar OpenEventA OpenEventW OpenFileMappingA OpenProcess OutputDebugStringA OutputDebugStringW PeekNamedPipe PostQueuedCompletionStatus PulseEvent QueryPerformanceCounter QueryPerformanceFrequency QueueUserWorkItem RaiseException ReadFile ReadFileEx ReadProcessMemory ReleaseMutex ReleaseSemaphore RemoveDirectoryW RemoveVectoredExceptionHandler ResetEvent ResumeThread RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetCurrentDirectoryW SetEndOfFile SetErrorMode SetEvent SetFileAttributesW SetFilePointer SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepConditionVariableCS SleepEx SuspendThread SwitchToThread SystemTimeToFileTime TerminateProcess TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter UnlockFile UnmapViewOfFile VirtualAlloc VirtualAllocEx VirtualFree VirtualFreeEx VirtualLock VirtualProtect VirtualQuery VirtualUnlock WaitForMultipleObjects WaitForMultipleObjectsEx WaitForSingleObject WaitForSingleObjectEx WaitNamedPipeW WakeAllConditionVariable WideCharToMultiByte WriteFile WriteFileEx __C_specific_handler lstrcmpW lstrlenW

msvcrt

___lc_codepage_func __argc __argv __dllonexit __doserrno __getmainargs __initenv __iob_func __lconv_init __mb_cur_max __pioinfo __set_app_type __setusermatherr _acmdln _amsg_exit _beginthread _beginthreadex _cexit _chsize _close _ctime64 _endthreadex _errno _exit _filelengthi64 _fileno _fmode _fstat64 _ftime _get_osfhandle _getch _getcwd _getdrive _getpid _gmtime64 _initterm _localtime64 _lock _lseeki64 _mktime64 _onexit _open _open_osfhandle _read _setjmp _setmode _snprintf _stat64 _strdup _stricmp _strnicmp _time64 _tzset _ultoa _unlock _vscprintf _vsnprintf _waccess _wchmod _wfopen _wgetdcwd _write abort acos asin atan atof atoi atol bsearch calloc exit fclose feof ferror fflush fgetc fgetpos fgets fopen fprintf fputc fputs fread free freopen frexp fseek fsetpos ftell fwprintf fwrite getc getenv getwc isalnum isalpha islower isprint isspace isupper iswctype isxdigit localeconv log10 malloc memchr memcmp memcpy memmove memset perror printf putc putchar puts putwc qsort raise rand realloc remove setbuf setlocale setvbuf signal sprintf srand sscanf strcat strchr strcmp strcoll strcpy strerror strftime strlen strncmp strncpy strpbrk strrchr strspn strstr strtol strtoul strxfrm swprintf_s system tan tolower toupper towlower towupper ungetc ungetwc vfprintf wcscmp wcscoll wcscpy wcsftime wcslen wcsncmp wcsrchr wcsstr wcstombs wcsxfrm _vsnwprintf _snwprintf longjmp _tzname _timezone _write _strdup _read _putenv _open _memicmp _fileno _fdopen _close

ole32

CoCreateGuid CoCreateInstance CoGetMalloc CoInitialize CoInitializeEx CoLockObjectExternal CoTaskMemFree CoUninitialize DoDragDrop OleFlushClipboard OleGetClipboard OleInitialize OleIsCurrentClipboard OleSetClipboard OleUninitialize RegisterDragDrop ReleaseStgMedium RevokeDragDrop StringFromGUID2

oleaut32

SysAllocStringLen VariantInit

shell32

CommandLineToArgvW SHBrowseForFolderW SHCreateItemFromIDList SHCreateItemFromParsingName SHGetFileInfoW SHGetKnownFolderIDList SHGetKnownFolderPath SHGetMalloc SHGetPathFromIDListW SHGetSpecialFolderPathA SHGetStockIconInfo ShellExecuteW Shell_NotifyIconW

shlwapi

PathFileExistsW PathRemoveFileSpecA

user32

AdjustWindowRectEx AttachThreadInput BeginPaint CallNextHookEx ChangeClipboardChain CharNextExA ChildWindowFromPointEx ClientToScreen CreateCaret CreateCursor CreateIconIndirect CreateWindowExW DefWindowProcW DestroyCaret DestroyCursor DestroyIcon DestroyWindow DispatchMessageW DrawIconEx EnableMenuItem EndPaint EnumDisplayMonitors EnumWindows FindWindowExW FindWindowW FlashWindowEx GetAncestor GetAsyncKeyState GetCapture GetCaretBlinkTime GetClassInfoW GetClientRect GetClipboardFormatNameW GetCursor GetCursorInfo GetCursorPos GetDC GetDesktopWindow GetDoubleClickTime GetFocus GetForegroundWindow GetIconInfo GetKeyState GetKeyboardLayout GetKeyboardLayoutList GetKeyboardState GetMenu GetMessageExtraInfo GetMonitorInfoW GetParent GetProcessWindowStation GetQueueStatus GetSysColor GetSysColorBrush GetSystemMenu GetSystemMetrics GetUpdateRect GetUserObjectInformationW GetWindowLongPtrW GetWindowLongW GetWindowPlacement GetWindowRect GetWindowTextW GetWindowThreadProcessId HideCaret InvalidateRect IsChild IsHungAppWindow IsIconic IsWindow IsWindowVisible IsZoomed KillTimer LoadCursorW LoadIconW LoadImageW MapVirtualKeyW MapWindowPoints MessageBeep MessageBoxW MonitorFromWindow MoveWindow MsgWaitForMultipleObjectsEx NotifyWinEvent PeekMessageW PostMessageW RealGetWindowClassW RegisterClassExW RegisterClassW RegisterClipboardFormatW RegisterDeviceNotificationW RegisterWindowMessageW ReleaseCapture ReleaseDC ScreenToClient SendMessageW SetCapture SetCaretPos SetClipboardViewer SetCursor SetCursorPos SetFocus SetForegroundWindow SetLayeredWindowAttributes SetMenuItemInfoW SetParent SetTimer SetWindowLongPtrW SetWindowLongW SetWindowPlacement SetWindowPos SetWindowRgn SetWindowTextW SetWindowsHookExW ShowWindow SystemParametersInfoW ToAscii ToUnicode TrackMouseEvent TrackPopupMenuEx TranslateMessage UnhookWindowsHookEx UnregisterClassW UnregisterDeviceNotification UpdateLayeredWindow UpdateLayeredWindowIndirect

uxtheme

CloseThemeData DrawThemeBackgroundEx GetCurrentThemeName GetThemeBackgroundRegion GetThemeBool GetThemeColor GetThemeEnumValue GetThemeInt GetThemeMargins GetThemePartSize GetThemePropertyOrigin GetThemeTransitionDuration IsAppThemed IsThemeActive IsThemeBackgroundPartiallyTransparent OpenThemeData SetWindowTheme

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

winmm

PlaySoundW timeKillEvent timeSetEvent

ws2_32

WSAAccept WSAAsyncSelect WSACleanup WSACloseEvent WSAConnect WSACreateEvent WSAEventSelect WSAGetLastError WSAGetOverlappedResult WSAHtonl WSAIoctl WSANtohl WSANtohs WSARecv WSARecvFrom WSASend WSASendTo WSASetLastError WSASocketW WSAStartup WSAWaitForMultipleEvents __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo gethostbyaddr gethostbyname gethostname getnameinfo getpeername getprotobynumber getservbyname getsockname getsockopt htonl htons inet_addr inet_ntoa ioctlsocket listen ntohl ntohs recv recvfrom select send sendto setsockopt shutdown socket

Name

.text

Size

21.0MB

Virtual Size

21.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

98KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

8.3MB

Virtual Size

8.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

288B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

739KB

Virtual Size

739KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

120B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

393KB

Virtual Size

392KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

111KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/16

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

788KB

Virtual Size

787KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/43

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/69

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/82

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/93

Size

209KB

Virtual Size

208KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/104

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

bluecoin-tx.exe

IMPHASH a26af0efb82be093e3ef0f4377ea9af5
SHA256 ae3781f68b0050be92afe4f4f3da055655178d35a51a5f157b796bf42dfa2e47
MD5 8dc5b6f61c3248a7f7441ce159284995
SHA1 3fb911a92d4aee6d7545bb0aaaf7a9a10785cf0c
SHA512 f20c2d6d0b17b439f9e3ae06d911fc749dbf3c1ba8bd44cc9c6d7d79bd746666d04cb73f3c7734a99621b9f2094a96778bf3f7e3798bc5cb279dc34b8c6a4320
SSDEEP 98304:LmPSNBvLvRS1YbQGUg+joEOcpO/lyo8oyDprmC1i0f+Q9efR/29CvC1LfgDZQjF3:v3S7pOAuy
TLSH
T1AF564B03A9875CEECDD7D77452A75336A734BC688B35AF2B6604D6311D53BC0AA2EB00
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5376

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateDCW DeleteDC DeleteObject GetBitmapBits GetDeviceCaps GetObjectW SelectObject

kernel32

AddVectoredExceptionHandler AreFileApisANSI CloseHandle CopyFileW CreateDirectoryExW CreateDirectoryW CreateEventA CreateFileA CreateFileW CreateSemaphoreA CreateWaitableTimerA DeleteCriticalSection DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection FindClose FindFirstFileW FindNextFileW FlushFileBuffers FormatMessageA FreeLibrary GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetEnvironmentVariableW GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileTime GetFileType GetFullPathNameW GetHandleInformation GetLastError GetLogicalProcessorInformation GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessAffinityMask GetProcessHeap GetStartupInfoA GetStdHandle GetSystemInfo GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount GetTimeZoneInformation GetVersion GetVersionExW GetWindowsDirectoryW GlobalMemoryStatus HeapAlloc HeapFree InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent LCMapStringW LeaveCriticalSection LoadLibraryW LocalFree LockFileEx MoveFileExA MoveFileExW MultiByteToWideChar OpenEventA OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSemaphore RemoveDirectoryW RemoveVectoredExceptionHandler ResetEvent ResumeThread RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetCurrentDirectoryW SetEndOfFile SetEvent SetFileAttributesW SetFilePointerEx SetFileTime SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SetWaitableTimer Sleep SuspendThread SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter VirtualAlloc VirtualLock VirtualProtect VirtualQuery VirtualUnlock WaitForMultipleObjects WaitForMultipleObjectsEx WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte __C_specific_handler

msvcrt

___lc_codepage_func __dllonexit __doserrno __getmainargs __initenv __iob_func __lconv_init __mb_cur_max __pioinfo __set_app_type __setusermatherr _acmdln _amsg_exit _beginthreadex _cexit _chsize _endthreadex _errno _exit _filelengthi64 _fileno _fmode _fstat64 _get_osfhandle _getch _gmtime64 _initterm _localtime64 _lock _lseeki64 _onexit _setjmp _setmode _stricmp _strnicmp _time64 _ultoa _unlock _wfopen _write abort atoi calloc exit fclose feof ferror fflush fgetpos fgets fopen fprintf fputc fputs fread free freopen fseek fsetpos ftell fwprintf fwrite getc getenv getwc isalnum islower isspace isupper iswctype isxdigit localeconv malloc memchr memcmp memcpy memmove memset printf putc putwc qsort raise realloc setbuf setlocale setvbuf signal sprintf sscanf strcat strchr strcmp strcoll strcpy strerror strftime strlen strncmp strncpy strrchr strtol strtoul strxfrm system tolower towlower towupper ungetc ungetwc vfprintf wcscoll wcscpy wcsftime wcslen wcsstr wcsxfrm _vsnwprintf _snwprintf longjmp _write _strdup _read _open _fileno _fdopen _close

shell32

SHGetSpecialFolderPathA

user32

GetDesktopWindow GetProcessWindowStation GetUserObjectInformationW MessageBoxW

ws2_32

WSAStartup

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

427KB

Virtual Size

427KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

105KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

150KB

Virtual Size

149KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

120B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

601KB

Virtual Size

601KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

164KB

Virtual Size

164KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

bluecoind.exe

IMPHASH 4f40d931f5eb0505e3246ba87fdcbbdb
SHA256 26dfe4ef018b9da511e3a8f674a552af53a6d935009672fbdb7de9a34b4592c2
MD5 7c8d9610a01c16fb02f2424e9e73a0d5
SHA1 71c8013b12dd47a6a189d66bd2d5199148ecba6f
SHA512 ce6cb8d5cec68bc5f2ba5a4e8862ed6271b01ece855ddfac274f668b1e8fdc041faa2336413f30559b4a8dd99b8e226a8e194c3446497fa18a7163e99bc65b0e
SSDEEP 98304:LhJ+bpKT0GGOJDjJkncYyevMVAP3MbY7MnLsoO4eeje2sXsH/Gugzb8gQD0RO3uU:LhEbp5yR27U4xb11Wj6a
TLSH
T1DC075C43A6975CEDC8C7D37462D343326A70BC5A8A367B5B6148C6342F53BD0AB2EB41
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5376

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateDCW DeleteDC DeleteObject GetBitmapBits GetDeviceCaps GetObjectW SelectObject

iphlpapi

GetAdaptersAddresses GetBestRoute GetIpAddrTable if_indextoname if_nametoindex

kernel32

AddVectoredExceptionHandler AreFileApisANSI CloseHandle CopyFileW CreateDirectoryA CreateDirectoryExW CreateDirectoryW CreateEventA CreateEventW CreateFileA CreateFileMappingA CreateFileW CreateIoCompletionPort CreateSemaphoreA CreateWaitableTimerA DeleteCriticalSection DeleteFileA DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection FileTimeToSystemTime FindClose FindFirstFileA FindFirstFileW FindNextFileA FindNextFileW FlushFileBuffers FormatMessageA FormatMessageW FreeLibrary GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceA GetDiskFreeSpaceExW GetEnvironmentVariableA GetEnvironmentVariableW GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFileTime GetFileType GetFullPathNameW GetHandleInformation GetLastError GetLocalTime GetLogicalProcessorInformation GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessAffinityMask GetProcessHeap GetProcessTimes GetQueuedCompletionStatus GetStartupInfoA GetStdHandle GetSystemDirectoryA GetSystemInfo GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempPathA GetTempPathW GetThreadContext GetThreadId GetThreadPriority GetThreadTimes GetTickCount GetTimeZoneInformation GetVersion GetVersionExA GetVersionExW GetWindowsDirectoryW GlobalMemoryStatus HeapAlloc HeapFree InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionAndSpinCount IsDBCSLeadByteEx IsDebuggerPresent LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryW LocalAlloc LocalFree LockFile LockFileEx MapViewOfFile MoveFileA MoveFileExA MoveFileExW MoveFileW MultiByteToWideChar OpenEventA OpenEventW OpenFileMappingA OutputDebugStringA PostQueuedCompletionStatus PulseEvent QueryPerformanceCounter QueryPerformanceFrequency QueueUserWorkItem RaiseException ReadFile ReleaseMutex ReleaseSemaphore RemoveDirectoryW RemoveVectoredExceptionHandler ResetEvent ResumeThread RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetCurrentDirectoryW SetEndOfFile SetEvent SetFileAttributesW SetFilePointer SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepConditionVariableCS SuspendThread SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter UnlockFile UnmapViewOfFile VirtualAlloc VirtualLock VirtualProtect VirtualQuery VirtualUnlock WaitForMultipleObjects WaitForMultipleObjectsEx WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WideCharToMultiByte WriteFile __C_specific_handler

msvcrt

___lc_codepage_func __dllonexit __doserrno __getmainargs __initenv __iob_func __lconv_init __mb_cur_max __pioinfo __set_app_type __setusermatherr _acmdln _amsg_exit _beginthread _beginthreadex _cexit _chsize _close _ctime64 _endthreadex _errno _exit _filelengthi64 _fileno _fmode _fstat64 _ftime _get_osfhandle _getch _getcwd _getpid _gmtime64 _initterm _localtime64 _lock _lseeki64 _onexit _open _read _setjmp _setmode _snprintf _strdup _stricmp _strnicmp _time64 _ultoa _unlock _vscprintf _vsnprintf _wfopen _write abort atoi atol calloc exit fclose feof ferror fflush fgetc fgetpos fgets fopen fprintf fputc fputs fread free freopen fseek fsetpos ftell fwprintf fwrite getc getenv getwc isalnum isalpha islower isprint isspace isupper iswctype isxdigit localeconv malloc memchr memcmp memcpy memmove memset perror printf putc putchar puts putwc qsort raise rand realloc setbuf setlocale setvbuf signal sprintf srand sscanf strcat strchr strcmp strcoll strcpy strerror strftime strlen strncmp strncpy strpbrk strrchr strspn strstr strtol strtoul strxfrm system tolower towlower towupper ungetc ungetwc vfprintf wcscoll wcscpy wcsftime wcslen wcsrchr wcsstr wcstombs wcsxfrm _vsnwprintf _snwprintf longjmp _write _strdup _read _open _memicmp _fileno _fdopen _close

shell32

SHGetSpecialFolderPathA

shlwapi

PathFileExistsW

user32

GetDesktopWindow GetProcessWindowStation GetUserObjectInformationW MessageBoxW

ws2_32

WSACleanup WSACloseEvent WSACreateEvent WSAEventSelect WSAGetLastError WSAGetOverlappedResult WSAIoctl WSARecv WSASend WSASetLastError WSAStartup WSAWaitForMultipleEvents __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo gethostbyname gethostname getnameinfo getpeername getprotobynumber getservbyname getsockname getsockopt htonl htons inet_addr inet_ntoa ioctlsocket listen ntohl ntohs recv recvfrom select send sendto setsockopt shutdown socket

Name

.text

Size

7.4MB

Virtual Size

7.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

250KB

Virtual Size

249KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

513KB

Virtual Size

513KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

120B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

656KB

Virtual Size

655KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

42KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

172KB

Virtual Size

171KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Bluecoin2-17-1-0-Windows64.zip

bluecoin-cli.exe

advapi32

gdi32

kernel32

msvcrt

shell32

user32

ws2_32

generic

bluecoin-qt.exe

advapi32

crypt32

dwmapi

gdi32

imm32

iphlpapi

kernel32

msvcrt

ole32

oleaut32

shell32

shlwapi

user32

uxtheme

version

winmm

ws2_32

generic

bluecoin-tx.exe

advapi32

gdi32

kernel32

msvcrt

shell32

user32

ws2_32

generic

bluecoind.exe

advapi32

gdi32

iphlpapi

kernel32

msvcrt

shell32

shlwapi

user32

ws2_32

generic