File name: | BlueLightCat 0.6 Installer.exe |
Full analysis: | https://app.any.run/tasks/bb821cfb-0354-4e2f-9995-ab1d6f1c9fbb |
Verdict: | Malicious activity |
Analysis date: | March 22, 2019, 12:09:18 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive |
MD5: | BB5DD5686C57DD7396088641665777EF |
SHA1: | B0EC15ECEC5E896DDB650C3A38E77ECFA99B8DD2 |
SHA256: | 6DA8BA2D25B50503FD3E429D62BA945E14BF543FBFA8592E2CDB3238CA09EB2F |
SSDEEP: | 196608:OaMORRWPfnKeW7yUN5ZpOvIjtZ5g4dV0U1eATdw04SMDAXujhcPq:O5ORQPftYZpOvsbgredf+zv |
.exe | | | NSIS - Nullsoft Scriptable Install System (94.8) |
---|---|---|
.exe | | | Win32 Executable MS Visual C++ (generic) (3.4) |
.dll | | | Win32 Dynamic Link Library (generic) (0.7) |
.exe | | | Win32 Executable (generic) (0.5) |
.exe | | | Generic Win/DOS Executable (0.2) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 2009:12:05 23:50:46+01:00 |
PEType: | PE32 |
LinkerVersion: | 6 |
CodeSize: | 23552 |
InitializedDataSize: | 119808 |
UninitializedDataSize: | 1024 |
EntryPoint: | 0x323c |
OSVersion: | 4 |
ImageVersion: | 6 |
SubsystemVersion: | 4 |
Subsystem: | Windows GUI |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 05-Dec-2009 22:50:46 |
Detected languages: |
|
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x000000D8 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 5 |
Time date stamp: | 05-Dec-2009 22:50:46 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x00005A5A | 0x00005C00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.4177 |
.rdata | 0x00007000 | 0x00001190 | 0x00001200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.18163 |
.data | 0x00009000 | 0x0001AF98 | 0x00000400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.70903 |
.ndata | 0x00024000 | 0x00009000 | 0x00000000 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.rsrc | 0x0002D000 | 0x00056DD0 | 0x00056E00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.26497 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.10394 | 533 | UNKNOWN | English - United States | RT_MANIFEST |
2 | 5.503 | 67624 | UNKNOWN | English - United States | RT_ICON |
3 | 6.03915 | 9640 | UNKNOWN | English - United States | RT_ICON |
4 | 6.26654 | 4264 | UNKNOWN | English - United States | RT_ICON |
5 | 6.3929 | 1128 | UNKNOWN | English - United States | RT_ICON |
103 | 2.6474 | 76 | UNKNOWN | English - United States | RT_GROUP_ICON |
105 | 2.73893 | 514 | UNKNOWN | English - United States | RT_DIALOG |
106 | 2.91148 | 248 | UNKNOWN | English - United States | RT_DIALOG |
107 | 2.52183 | 160 | UNKNOWN | English - United States | RT_DIALOG |
111 | 2.92787 | 238 | UNKNOWN | English - United States | RT_DIALOG |
ADVAPI32.dll |
COMCTL32.dll |
GDI32.dll |
KERNEL32.dll |
SHELL32.dll |
USER32.dll |
VERSION.dll |
ole32.dll |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2592 | "C:\Users\admin\AppData\Local\Temp\BlueLightCat 0.6 Installer.exe" | C:\Users\admin\AppData\Local\Temp\BlueLightCat 0.6 Installer.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221226540 Modules
| |||||||||||||||
2956 | "C:\Users\admin\AppData\Local\Temp\BlueLightCat 0.6 Installer.exe" | C:\Users\admin\AppData\Local\Temp\BlueLightCat 0.6 Installer.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
1640 | "C:\Program Files\BlueLightCat\bluelightcat.exe" | C:\Program Files\BlueLightCat\bluelightcat.exe | BlueLightCat 0.6 Installer.exe | ||||||||||||
User: admin Integrity Level: HIGH Modules
|
(PID) Process: | (2956) BlueLightCat 0.6 Installer.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\bluelightcat.exe |
Operation: | write | Name: | |
Value: C:\Program Files\BlueLightCat\bluelightcat.exe | |||
(PID) Process: | (2956) BlueLightCat 0.6 Installer.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BlueLightCat |
Operation: | write | Name: | DisplayName |
Value: BlueLightCat 0.6 | |||
(PID) Process: | (2956) BlueLightCat 0.6 Installer.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BlueLightCat |
Operation: | write | Name: | UninstallString |
Value: C:\Program Files\BlueLightCat\uninst.exe | |||
(PID) Process: | (2956) BlueLightCat 0.6 Installer.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BlueLightCat |
Operation: | write | Name: | DisplayIcon |
Value: C:\Program Files\BlueLightCat\bluelightcat.exe | |||
(PID) Process: | (2956) BlueLightCat 0.6 Installer.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BlueLightCat |
Operation: | write | Name: | DisplayVersion |
Value: 0.6 | |||
(PID) Process: | (1640) bluelightcat.exe | Key: | HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Plugin Cache 4.8.false\C:\Program Files\BlueLightCat\iconengines |
Operation: | write | Name: | qsvgicon4.dll |
Value: 40800 | |||
(PID) Process: | (1640) bluelightcat.exe | Key: | HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Plugin Cache 4.8.false\C:\Program Files\BlueLightCat\imageformats |
Operation: | write | Name: | qgif4.dll |
Value: 40800 | |||
(PID) Process: | (1640) bluelightcat.exe | Key: | HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.8\com.trolltech.Qt.QImageIOHandlerFactoryInterface:\C:\Program Files\BlueLightCat\imageformats |
Operation: | write | Name: | qgif4.dll |
Value: 2012-03-11T14:31:28 | |||
(PID) Process: | (1640) bluelightcat.exe | Key: | HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Plugin Cache 4.8.false\C:\Program Files\BlueLightCat\imageformats |
Operation: | write | Name: | qico4.dll |
Value: 40800 | |||
(PID) Process: | (1640) bluelightcat.exe | Key: | HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.8\com.trolltech.Qt.QImageIOHandlerFactoryInterface:\C:\Program Files\BlueLightCat\imageformats |
Operation: | write | Name: | qico4.dll |
Value: 2012-03-11T14:31:48 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2956 | BlueLightCat 0.6 Installer.exe | C:\Users\admin\AppData\Local\Temp\nskA030.tmp\ioSpecial.ini | text | |
MD5:4FB265C52BBD695031B9736D3E4F07F9 | SHA256:6C05DB0CD652B85D9EF9FC6ACEE421547E1C1C51E6FE98C6689BBB56259FC1E6 | |||
2956 | BlueLightCat 0.6 Installer.exe | C:\Program Files\BlueLightCat\bluelightcat-cacheinfo.exe | o | |
MD5:FBE353D94D326D1C724D14CB13016136 | SHA256:326F1ECE9A0CD63B5F6580F89345EB0411A8DE5F074BB00E48D97FDA26D169C2 | |||
2956 | BlueLightCat 0.6 Installer.exe | C:\Program Files\BlueLightCat\QtCore4.dll | executable | |
MD5:CF8669B183D11179CB5CC67802CBD99C | SHA256:4E2154A5F4CC842825B7112322814E76B03E8F033A191A1BF120E883FC0DA31C | |||
2956 | BlueLightCat 0.6 Installer.exe | C:\Program Files\BlueLightCat\locale\ast.qm | qm | |
MD5:274215A4249C0ABF4587796CE9B45876 | SHA256:241959560CD319EA4BDD2ECC1AA2F89D14BDD305380F7D60AA95E201DA63A7F7 | |||
2956 | BlueLightCat 0.6 Installer.exe | C:\Program Files\BlueLightCat\bluelightcat-placesimport.exe | o | |
MD5:86FF377CD4E222CE0794FC277E3B1C0B | SHA256:62ACF8769047AD9E1DD3A8BD4112584594126A0B7E1F0CFB78FA9AB9CDE2948B | |||
2956 | BlueLightCat 0.6 Installer.exe | C:\Program Files\BlueLightCat\locale\ca.qm | qm | |
MD5:0DB72459F49B03EF9C1AA89249839AE1 | SHA256:4E6B2AA6770CDAAE63CB907EAC1C053B07B83C86C81B9C9C060F03B862449CB4 | |||
2956 | BlueLightCat 0.6 Installer.exe | C:\Program Files\BlueLightCat\htmlToXBel.exe | o | |
MD5:7BABD3D0357F288A418DFDC8B77EFBA6 | SHA256:03CBAE06C64160526258B6FA3381BFB5DF775E834CBEB8EB66C36AF3E8344BEA | |||
2956 | BlueLightCat 0.6 Installer.exe | C:\Users\admin\AppData\Local\Temp\nskA030.tmp\InstallOptions.dll | executable | |
MD5:325B008AEC81E5AAA57096F05D4212B5 | SHA256:C9CD5C9609E70005926AE5171726A4142FFBCCCC771D307EFCD195DAFC1E6B4B | |||
2956 | BlueLightCat 0.6 Installer.exe | C:\Program Files\BlueLightCat\bluelightcat.exe | executable | |
MD5:F1B5B183BE7290329938CD1B6F4BC246 | SHA256:C7472D9B78ACAD08781B459FEE41C8DCCDE7725A6D8437125D361FFC8BBC7534 | |||
2956 | BlueLightCat 0.6 Installer.exe | C:\Program Files\BlueLightCat\locale\cs_CZ.qm | qm | |
MD5:5187FD851CAD8C9674607EBD949FBA46 | SHA256:B1C897756A8C726162E8E804F42E628D2CADE58582E7FA1BC2107C911448C158 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1640 | bluelightcat.exe | GET | 204 | 216.58.207.36:80 | http://www.google.com/gen_204?atyp=i&ct=backbutton&cad=&tt=popstate&ei=ntCUXOvTI4ivkwXN06OoBg&zx=1553256607084 | US | — | — | whitelisted |
1640 | bluelightcat.exe | GET | — | 216.58.207.36:80 | http://www.google.com/textinputassistant/tia.png | US | — | — | whitelisted |
1640 | bluelightcat.exe | GET | 204 | 216.58.207.36:80 | http://www.google.com/client_204?&atyp=i&biw=853&bih=426&ei=ntCUXOvTI4ivkwXN06OoBg | US | — | — | whitelisted |
1640 | bluelightcat.exe | GET | — | 216.58.207.36:80 | http://www.google.com/images/branding/googlelogo/1x/googlelogo_white_background_color_272x92dp.png | US | — | — | whitelisted |
1640 | bluelightcat.exe | GET | 204 | 172.217.16.142:80 | http://clients1.google.com/generate_204 | US | — | — | whitelisted |
1640 | bluelightcat.exe | GET | 200 | 216.58.207.36:80 | http://www.google.com/ | US | html | 15.5 Kb | whitelisted |
1640 | bluelightcat.exe | GET | 200 | 172.217.16.142:80 | http://clients1.google.com/complete/search?client=heirloom-hp&hl=no&gs_rn=34&gs_ri=heirloom-hp&cp=1&gs_id=4&q=w | US | text | 219 b | whitelisted |
1640 | bluelightcat.exe | GET | 200 | 172.217.16.142:80 | http://clients1.google.com/complete/search?client=heirloom-hp&hl=no&gs_rn=34&gs_ri=heirloom-hp&cp=2&gs_id=7&q=wt | US | text | 184 b | whitelisted |
1640 | bluelightcat.exe | GET | 200 | 172.217.22.99:80 | http://ssl.gstatic.com/gb/js/sem_5d0e9a88d640580d12b41844f0901e23.js | US | text | 20.2 Kb | whitelisted |
1640 | bluelightcat.exe | GET | 200 | 172.217.16.142:80 | http://clients1.google.com/complete/search?client=heirloom-hp&hl=no&gs_rn=34&gs_ri=heirloom-hp&cp=3&gs_id=c&q=wtf | US | text | 177 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1640 | bluelightcat.exe | 140.211.166.81:80 | adblockplus.mozdev.org | Network for Education and Research in Oregon (NERO) | US | suspicious |
1640 | bluelightcat.exe | 172.217.22.99:443 | ssl.gstatic.com | Google Inc. | US | whitelisted |
1640 | bluelightcat.exe | 88.99.186.148:443 | easylist-downloads.adblockplus.org | Hetzner Online GmbH | DE | unknown |
1640 | bluelightcat.exe | 172.217.16.142:80 | clients1.google.com | Google Inc. | US | whitelisted |
1640 | bluelightcat.exe | 216.58.205.238:80 | — | Google Inc. | US | whitelisted |
1640 | bluelightcat.exe | 172.217.22.99:80 | ssl.gstatic.com | Google Inc. | US | whitelisted |
1640 | bluelightcat.exe | 216.58.207.36:80 | www.google.com | Google Inc. | US | whitelisted |
1640 | bluelightcat.exe | 172.217.21.195:443 | www.gstatic.com | Google Inc. | US | whitelisted |
1640 | bluelightcat.exe | 216.58.207.36:443 | www.google.com | Google Inc. | US | whitelisted |
1640 | bluelightcat.exe | 204.79.197.200:443 | bing.com | Microsoft Corporation | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
adblockplus.mozdev.org |
| suspicious |
easylist-downloads.adblockplus.org |
| suspicious |
www.google.com |
| whitelisted |
ssl.gstatic.com |
| whitelisted |
clients1.google.com |
| whitelisted |
www.gstatic.com |
| whitelisted |
fonts.googleapis.com |
| whitelisted |
bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
login.live.com |
| whitelisted |
Process | Message |
---|---|
bluelightcat.exe | QFont::setPixelSize: Pixel size <= 0 (0)
|
bluelightcat.exe | QNetworkReplyImplPrivate::error: Internal problem, this method must only be called once.
|
bluelightcat.exe | QNetworkReplyImplPrivate::error: Internal problem, this method must only be called once.
|