blossom[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
blossom.exe
Size 36.4MB
Sample261009-wxnbbadd33
SHA256 efadd394169393e87df72e6e5de987031fe0f99084567ba3e432ec1e9663a020
MD5 ae4eb8ebd62b7e08497355183c5b5e6a
SHA1 5c85c33fff2e00744208b7b32cfe476a9b8ebd66
SHA512 18678b75097648a1e55fa64a41c69d0a1361120ed846968c33a92649544e9bd2e31720e4ddd2d32f398cda5841c92ae29aa016ca39c17caa02179b2588fc94e1
SSDEEP 786432:0LxOk0MCoClnyVk4PiLBo1VPANH8ICvl967YymVj/VKkb01w55AkbrKfENRc:0LOBrwVALC1VPA9gldbQkbH55AkCfEN6
TLSH
T15C872242F283C158C95668398E42EAE693317C196F1206AB329CFF2F6FB76D14D75B01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
blossom.exe

File Explorer

blossom.exe

.exe 36.4MB

blossom.exe

IMPHASH c125bfaea24680ccde8c5800cb32e708
SHA256 efadd394169393e87df72e6e5de987031fe0f99084567ba3e432ec1e9663a020
MD5 ae4eb8ebd62b7e08497355183c5b5e6a
SHA1 5c85c33fff2e00744208b7b32cfe476a9b8ebd66
SHA512 18678b75097648a1e55fa64a41c69d0a1361120ed846968c33a92649544e9bd2e31720e4ddd2d32f398cda5841c92ae29aa016ca39c17caa02179b2588fc94e1
SSDEEP 786432:0LxOk0MCoClnyVk4PiLBo1VPANH8ICvl967YymVj/VKkb01w55AkbrKfENRc:0LOBrwVALC1VPA9gldbQkbH55AkCfEN6
TLSH
T15C872242F283C158C95668398E42EAE693317C196F1206AB329CFF2F6FB76D14D75B01
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1660592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

Sleep GetModuleFileNameA FindFirstFileA FindNextFileA FindClose GetTickCount QueryPerformanceFrequency QueryPerformanceCounter Process32First Module32Next GetProcessId Module32First OpenProcess CreateToolhelp32Snapshot Process32Next GetProcessTimes VirtualProtect GetCommandLineW GetCurrentProcess TerminateProcess GetModuleFileNameW WaitForSingleObject CreateEventW SetEvent LocalFree ExitProcess GetCurrentProcessId CreateProcessW IsDebuggerPresent CheckRemoteDebuggerPresent GetExitCodeProcess SizeofResource FindResourceA LockResource LoadResource ReadProcessMemory MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA CreateFileA GetFileSizeEx ReadFile AllocConsole HeapFree MapViewOfFile UnmapViewOfFile CreateFileMappingA GetModuleHandleA InitializeSListHead GetSystemTimeAsFileTime SetUnhandledExceptionFilter WakeAllConditionVariable GetFileInformationByHandleEx GetModuleHandleW AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW CreateDirectoryW SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetLocaleInfoEx FormatMessageA WriteConsoleW GetVolumeInformationA GetConsoleWindow GetProcAddress CloseHandle GetConsoleMode GetCurrentThreadId CreateMutexA SetConsoleMode GetStdHandle GetLastError SetConsoleTitleA HeapAlloc

user32

SetWindowLongA GetCapture TrackMouseEvent SetCapture DestroyWindow DispatchMessageA SetClipboardData GetClipboardData EmptyClipboard CloseClipboard GetSystemMetrics SetWindowDisplayAffinity MessageBoxA DefWindowProcA CreateWindowExA SetLayeredWindowAttributes TranslateMessage PeekMessageA PostQuitMessage RegisterClassExA UpdateWindow GetWindowRect IsWindowVisible SetCursor EnumWindows FindWindowA IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard ScreenToClient GetKeyboardLayout MapVirtualKeyExA GetAsyncKeyState ClientToScreen GetClientRect GetCursorPos SendInput GetWindowThreadProcessId MessageBoxW ShowWindow IsWindow SetWindowPos AttachThreadInput GetForegroundWindow SetFocus BringWindowToTop SetForegroundWindow LoadCursorA GetMessageExtraInfo GetKeyState

advapi32

RegCloseKey RegQueryValueExA RegOpenKeyExA

shell32

CommandLineToArgvW SHGetFolderPathA

msvcp140

?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z _Cnd_wait ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??7ios_base@std@@QEBA_NXZ ?_Random_device@std@@YAIXZ _Cnd_signal ?always_noconv@codecvt_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Xbad_function_call@std@@YAXXZ _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$numpunct@D@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach _Xtime_get_ticks ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?uncaught_exceptions@std@@YAHXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?good@ios_base@std@@QEBA_NXZ _Mtx_lock _Mtx_unlock ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??Bios_base@std@@QEBA_NXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z

vmprotectsdk64

VMProtectDecryptStringA VMProtectIsDebuggerPresent VMProtectBeginVirtualization VMProtectBeginUltra VMProtectIsValidImageCRC VMProtectEnd

winhttp

WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpConnect WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpSetTimeouts WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpSendRequest WinHttpOpen

d3dcompiler_47

D3DCompile

winmm

PlaySoundA

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __std_exception_destroy __std_exception_copy __std_terminate strchr __intrinsic_setjmp wcschr __current_exception_context strstr __current_exception strrchr longjmp memcpy memmove memset memchr memcmp __C_specific_handler

api-ms-win-crt-heap-l1-1-0

calloc _set_new_mode malloc free _callnewh realloc

api-ms-win-crt-math-l1-1-0

floor pow acosf expf _dsign ldexp asinf fmodf nearbyint powf roundf atan2f lroundf sin __setusermatherr sinf _ldsign cosf _fdsign

api-ms-win-crt-runtime-l1-1-0

__p___argv _c_exit _register_thread_local_exe_atexit_callback _exit _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe __p___argc abort _cexit _crt_atexit _register_onexit_function _initialize_onexit_table exit _configure_narrow_argv _errno terminate _beginthreadex _initterm_e _initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

fseek __p__commode _set_fmode _get_osfhandle _fileno __acrt_iob_func _fwrite_nolock fflush _fflush_nolock freopen_s __stdio_common_vsprintf _wfopen __stdio_common_vfprintf __stdio_common_vswprintf_s fputc ftell fwrite fclose _get_stream_buffer_pointers _fseeki64 __stdio_common_vsscanf fread fsetpos ungetc setvbuf fgetpos fgetc

api-ms-win-crt-time-l1-1-0

_localtime64_s strftime

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file remove

api-ms-win-crt-convert-l1-1-0

atoi strtof wcstoull _wtoi strtoll strtod atof strtoull strtol

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func localeconv _configthreadlocale

api-ms-win-crt-string-l1-1-0

strncpy_s tolower strcpy_s strncpy strlen strcmp strncmp _stricmp wcslen

api-ms-win-crt-utility-l1-1-0

rand qsort

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

995KB

Virtual Size

994KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

718KB

Virtual Size

736KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

69KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

33.0MB

Virtual Size

33.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

blossom.exe

d3d11

kernel32

user32

advapi32

shell32

msvcp140

vmprotectsdk64

winhttp

d3dcompiler_47

winmm

imm32

dwmapi

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

generic