halo[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

halo.exe
Size

2.7MB
MD5

4c12421ed6277e1914abda73fee2b501
SHA1

fa943a7d3ca64683f2ebf59f4680ca5cb15a3c94
SHA256

0573ff3518837e8dac0a3a3324e09e2be8f7357ee5a45ac929889cacb9926743
SHA512

7bd5710146ada353dcf716c56d51b4ebe6685ff985b4d0ef9bd0a83fcbd9f2d206d998fff80708263641025f3c690c16c10109feeb00a0c97a98175892a0482d
SSDEEP

49152:gwo336rYHyRP5TPbTGZCO5asQRie+lExjvO0rGy0j/9:gQr+yXjTGZT0PRieFbOiGy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
halo.exe

Files

halo.exe
.exe windows x86

5c6e636ce12b8d4110bb8f4aedf61daf

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

inet_ntoa
recvfrom
WSAGetLastError
setsockopt
sendto
socket
gethostname
WSAStartup
gethostbyname
inet_addr

dsound

ord9

winmm

timeEndPeriod
timeBeginPeriod

kernel32

SetLastError
ReadFileEx
SystemTimeToFileTime
CompareFileTime
SetFileTime
ReadFile
GetFileTime
GetSystemTime
WriteFile
VirtualFree
VirtualAlloc
ExitProcess
GlobalMemoryStatus
SetErrorMode
QueryPerformanceCounter
GlobalAlloc
GetFileAttributesA
CreateDirectoryA
GlobalFree
QueryPerformanceFrequency
GetCurrentProcessId
GlobalReAlloc
GetCurrentThread
GetTickCount
FillConsoleOutputCharacterA
GetNumberOfConsoleInputEvents
WriteConsoleOutputCharacterA
ReadConsoleInputA
SetConsoleCursorPosition
GetStdHandle
WriteConsoleA
GetConsoleScreenBufferInfo
SetConsoleCursorInfo
FillConsoleOutputAttribute
GetConsoleCursorInfo
GetTimeFormatA
GetDateFormatA
VirtualQuery
GetLocalTime
GetModuleFileNameA
FreeLibrary
FormatMessageA
GetProcAddress
LoadLibraryA
LocalFree
SetThreadLocale
GetThreadLocale
FindFirstFileA
CopyFileA
FindClose
FindNextFileA
DeleteFileA
GetDiskFreeSpaceExA
GetCurrentProcess
GlobalLock
GetACP
GlobalUnlock
LocalAlloc
GetCurrentDirectoryA
GetVersionExA
GetLastError
SetPriorityClass
GetPriorityClass
CreateProcessA
MultiByteToWideChar
GetModuleHandleA
GetCurrentThreadId
DuplicateHandle
RemoveDirectoryA
GetFileAttributesExA
SetFileAttributesA
WideCharToMultiByte
GetThreadPriority
LoadResource
FindResourceExA
LockResource
CreateFileW
SizeofResource
FindResourceA
FindResourceW
GetSystemInfo
IsProcessorFeaturePresent
lstrcmpiA
GetFullPathNameA
HeapAlloc
GetProcessHeap
HeapFree
CompareStringA
GetStringTypeW
GetStringTypeA
IsValidCodePage
IsValidLocale
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InterlockedExchange
RaiseException
GetSystemTimeAsFileTime
TerminateProcess
GetStartupInfoA
GetCommandLineA
RtlUnwind
HeapReAlloc
FlushFileBuffers
SetHandleCount
GetFileType
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
LCMapStringA
LCMapStringW
HeapSize
GetTimeZoneInformation
GetOEMCP
GetCPInfo
UnhandledExceptionFilter
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
CreateEventA
WaitForSingleObjectEx
SleepEx
SetEvent
VirtualProtect
Sleep
CreateFileMappingA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
SetFilePointer
GetFileSize
CreateFileA
ExitThread
TerminateThread
CreateThread
ResumeThread
CloseHandle
ReleaseMutex
CreateMutexA
GetExitCodeThread
SetThreadPriority
WaitForSingleObject
CompareStringW
SetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
IsBadWritePtr
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetLocaleInfoW
GetTempPathA
SetEnvironmentVariableA
InitializeCriticalSection

vorbisfile

ov_clear
ov_crosslap
ov_open_callbacks
ov_read

user32

LoadStringA
GetParent
RemovePropA
SendMessageA
PtInRect
GetCapture
SetPropA
InvalidateRect
GetWindowLongA
GetDlgItem
EndDialog
IsDlgButtonChecked
ReleaseCapture
SetWindowTextA
EnableWindow
CallWindowProcA
DialogBoxIndirectParamA
DialogBoxParamA
SetDlgItemTextA
CreateDialogIndirectParamA
GetPropA
GetWindowPlacement
FindWindowA
CloseClipboard
PostQuitMessage
IsClipboardFormatAvailable
wsprintfA
GetClientRect
GetDoubleClickTime
GetForegroundWindow
GetClipboardData
DefWindowProcA
OpenClipboard
ValidateRect
DestroyWindow
SetActiveWindow
RegisterClassExA
SetForegroundWindow
LoadBitmapA
LoadIconA
SetFocus
GetDC
SetCapture
ClientToScreen
SetWindowPos
ShowCursor
SetWindowLongA
UnregisterClassA
CreateWindowExA
ReleaseDC
ShowWindow
AdjustWindowRect
MoveWindow
MsgWaitForMultipleObjects
GetCursorPos
GetWindowRect
GetDesktopWindow
GetKeyState
GetAsyncKeyState
GetActiveWindow
GetSystemMetrics
SetCursor
MessageBoxA
LoadCursorA
TranslateMessage
PeekMessageA
DispatchMessageA

gdi32

SetTextColor
CreateFontIndirectA
StretchBlt
GetObjectA
GetDeviceGammaRamp
SetDeviceGammaRamp
GetDeviceCaps
DeleteObject
CreateCompatibleDC
SelectObject

advapi32

OpenThreadToken
RegOpenKeyA
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
GetLengthSid
IsValidSecurityDescriptor
RegQueryValueExA
FreeSid
AddAccessAllowedAce
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegCreateKeyExA
OpenProcessToken
SetSecurityDescriptorGroup
AccessCheck
DuplicateToken
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
InitializeAcl
AllocateAndInitializeSid
SetSecurityDescriptorOwner

ole32

CoCreateInstance
StringFromGUID2
CoInitialize
CoUninitialize
CLSIDFromString

oleaut32

VariantInit
VariantClear

binkw32

_BinkSetSoundSystem@8
_BinkDoFrame@4
_BinkOpenDirectSound@4
_BinkCopyToBuffer@28
_BinkPause@8
_BinkNextFrame@4
_BinkOpen@8
_BinkWait@4
_BinkClose@4

wininet

InternetQueryOptionA

wsock32

__WSAFDIsSet
ntohl
htonl
ntohs
htons
getsockname
closesocket
bind
select
send
WSACleanup
inet_ntoa
shutdown
recv
connect

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 236KB - Virtual size: 236KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 168KB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5c6e636ce12b8d4110bb8f4aedf61daf

Headers

File Characteristics

Imports

ws2_32

dsound

winmm

kernel32

vorbisfile

user32

gdi32

advapi32

ole32

oleaut32

binkw32

wininet

wsock32

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.rdata Size: 236KB - Virtual size: 236KB

.data Size: 168KB - Virtual size: 2.0MB

.tls Size: 4KB - Virtual size: 4KB

.rsrc Size: 60KB - Virtual size: 60KB

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 236KB - Virtual size: 236KB

.data
Size: 168KB - Virtual size: 2.0MB

.tls
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 60KB - Virtual size: 60KB