Bloxstrap-v2[.]11[.]4[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Bloxstrap-v2.11.4.exe
Size 12.0MB
Sample261002-vf3t1aef33
SHA256 9ad7758093a356fe5bd9d49911aaacf766dbb9289b6f3662a8ed3242230f46b2
MD5 f408c18edc86d2dc33385c2f11a57fb7
SHA1 84d9e3ef605d7ef184e8e24d6f8c0ec5670fa98a
SHA512 dc66eaa2faf81fb28ad7580977b3741fd93505a7c08cce0831a8f89145dfee278758101454371861ef47fb8ab291e0578809b7b0e50e83721fb05730fea539b6
SSDEEP 98304:CGiOBTscod5DkasbM11f1uD3P9uOYoHwfLk3vSmaR0+Mc4AN0edaAHDfysrTlz:CGiascgsbM1HAUObAbN08
TLSH
T107C66C8533FC1A35E3B74B35A970721A05767C2EA901D79F4B85BA1D29B2380CDE0B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Bloxstrap-v2.11.4.exe

.exe 12.0MB

Bloxstrap-v2.11.4.exe

IMPHASH a8308de57fce070f4cb88c7f43bf4b27
SHA256 9ad7758093a356fe5bd9d49911aaacf766dbb9289b6f3662a8ed3242230f46b2
MD5 f408c18edc86d2dc33385c2f11a57fb7
SHA1 84d9e3ef605d7ef184e8e24d6f8c0ec5670fa98a
SHA512 dc66eaa2faf81fb28ad7580977b3741fd93505a7c08cce0831a8f89145dfee278758101454371861ef47fb8ab291e0578809b7b0e50e83721fb05730fea539b6
SSDEEP 98304:CGiOBTscod5DkasbM11f1uD3P9uOYoHwfLk3vSmaR0+Mc4AN0edaAHDfysrTlz:CGiascgsbM1HAUObAbN08
TLSH
T107C66C8533FC1A35E3B74B35A970721A05767C2EA901D79F4B85BA1D29B2380CDE0B67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

e7:89:26:1e:e8:aa:d7:aa:fe:e1:56:46:a4:9e:77:81:ff:28:bf:41:a4:80:e9:f6:5c:81:35:c1:dd:96:80:25

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=SignPath Foundation,O=SignPath Foundation,L=Lewes,ST=Delaware,C=US

Chains

Aug 5, 2026

CN=SignPath Foundation,O=SignPath Foundation,L=Lewes,ST=Delaware,C=US

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2020 - Mar 18, 2045

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=SignPath Foundation,O=SignPath Foundation,L=Lewes,ST=Delaware,C=US

Serial Number

76:b1:85:1f:ab:ba:58:cb:03:94:e6:ce

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 25, 2024 - Sep 7, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

82000

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb

kernel32

FindNextFileW GetCurrentProcess GetModuleHandleExW GetModuleFileNameW LeaveCriticalSection GetEnvironmentVariableW FindClose MultiByteToWideChar GetLastError GetFileAttributesExW GetFullPathNameW GetProcAddress DeleteCriticalSection WideCharToMultiByte IsWow64Process LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc EnterCriticalSection FindFirstFileExW OutputDebugStringW LoadLibraryA GetModuleHandleW InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetCurrentProcessId IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW SwitchToThread GetCurrentThreadId InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime

user32

MessageBoxW

shell32

ShellExecuteW

advapi32

RegOpenKeyExW RegGetValueW DeregisterEventSource RegisterEventSourceW ReportEventW RegCloseKey

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv _initterm _get_initial_wide_environment _initialize_wide_environment _errno _configure_wide_argv _invalid_parameter_noinfo_noreturn _set_app_type _seh_filter_exe _c_exit exit _cexit _register_thread_local_exe_atexit_callback _crt_atexit _exit _initterm_e abort _register_onexit_function _initialize_onexit_table terminate

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vsprintf_s setvbuf _wfopen _set_fmode __stdio_common_vswprintf __acrt_iob_func fputwc fputws __stdio_common_vfwprintf fflush

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc calloc

api-ms-win-crt-string-l1-1-0

wcsnlen strcpy_s _wcsdup strcspn wcsncmp toupper

api-ms-win-crt-convert-l1-1-0

_wtoi wcstoul

api-ms-win-crt-locale-l1-1-0

__pctype_func _unlock_locales localeconv _lock_locales ___lc_codepage_func ___mb_cur_max_func _configthreadlocale setlocale ___lc_locale_name_func

api-ms-win-crt-math-l1-1-0

__setusermatherr frexp

api-ms-win-crt-time-l1-1-0

_gmtime64_s wcsftime _time64

Name

.text

Size

97KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

134KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

792B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Bloxstrap-v2.11.4.exe

kernel32

user32

shell32

advapi32

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

generic