esquele[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

esquele.exe
Size

71.3MB
MD5

e2e2a7d59b7e515b83872936ba5ebe1c
SHA1

202a0e2246dc90cf2de92a0bdd026824346f4903
SHA256

004b52b1904df7dc30925d75399bb644036c2cb42b575d80e8d265beab5b7b3e
SHA512

7c67ae1ae7f35482fe9daeb370f2d1737d4cca5c6b3fe1553226713ce0fd2b1c6e77d422e0546519c976c5d5c21e5025672f249497fd6b92c775d330f3714a3f
SSDEEP

393216:Lqr6n+O6dcCeYfTKAWXpSLT6WQkOfNFxbYBFrPpwlCEKQrolL3djP/qqAxgvBwVc:LqE+7OCeC2AWmw6LNagCk20Yd0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
esquele.exe

Files

esquele.exe
.exe windows x64

4a116919f367438e6f5eb6901ef89463

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

RtlCaptureStackBackTrace
RtlDeleteFunctionTable
RtlAddFunctionTable
RtlGetVersion
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
NtCreateFile
VerSetConditionMask
NtDeviceIoControlFile
RtlUnwindEx
RtlPcToFileHeader
RtlNtStatusToDosError
NtCancelIoFileEx
RtlUnwind

iphlpapi

GetAdaptersAddresses

kernel32

IsValidCodePage
OpenProcess
WaitForSingleObject
SetLastError
GetFullPathNameW
GetLastError
GetCurrentProcess
GetStdHandle
SwitchToThread
DeviceIoControl
FreeEnvironmentStringsW
GetExitCodeProcess
GetConsoleScreenBufferInfo
HeapReAlloc
ReleaseSRWLockExclusive
CreateFileA
SetStdHandle
GetHandleInformation
AddVectoredExceptionHandler
SetThreadStackGuarantee
HeapAlloc
GetProcessHeap
HeapFree
GetFileInformationByHandleEx
GetConsoleMode
AcquireSRWLockShared
ReleaseSRWLockShared
WakeAllConditionVariable
SleepConditionVariableSRW
GlobalUnlock
GetStringTypeW
Sleep
GetProcAddress
CreateFileW
GetFileInformationByHandle
SetCurrentDirectoryW
GetFileSizeEx
GetConsoleOutputCP
EnumSystemLocalesW
GetUserDefaultLCID
GetCurrentProcessId
IsValidLocale
WriteConsoleInputW
PeekConsoleInputW
FlushConsoleInputBuffer
TerminateProcess
GetLocaleInfoW
GlobalMemoryStatusEx
GetTickCount64
LCMapStringW
CreateToolhelp32Snapshot
Process32First
Process32Next
SetThreadErrorMode
LoadLibraryExW
FreeLibrary
CompareStringW
SetErrorMode
LoadLibraryW
FormatMessageW
TryAcquireSRWLockShared
SetFileTime
GetOEMCP
ResolveLocaleName
GetFileType
UnmapViewOfFile
GetSystemInfo
VirtualProtect
CreateFileMappingW
MapViewOfFile
TryAcquireSRWLockExclusive
GetQueuedCompletionStatusEx
CreateIoCompletionPort
SetFileCompletionNotificationModes
GetTimeFormatW
GetDateFormatW
FlsFree
GetCommandLineA
GetCPInfo
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
EncodePointer
WaitForSingleObjectEx
CreateSemaphoreW
CancelIo
ReadDirectoryChangesW
ReleaseSemaphore
CreatePipe
GetModuleHandleA
GetCurrencyFormatEx
WakeConditionVariable
GetConsoleCursorInfo
SetConsoleCursorInfo
InterlockedPushEntrySList
GetStartupInfoW
GlobalLock
GlobalSize
WideCharToMultiByte
ReadConsoleInputW
WriteConsoleW
FillConsoleOutputCharacterA
FillConsoleOutputAttribute
lstrlenW
InitializeSListHead
GetNumberFormatEx
IsThreadAFiber
ConvertThreadToFiber
CreateFiber
SwitchToFiber
DeleteFiber
GetACP
GetCurrentThread
GetCurrentDirectoryW
LoadLibraryA
CreateMutexA
ReleaseMutex
GetEnvironmentVariableW
GetEnvironmentStringsW
GetModuleHandleW
SetEnvironmentVariableW
GetTempPathW
GetModuleFileNameW
GetCommandLineW
FlushFileBuffers
SetFileInformationByHandle
GetFinalPathNameByHandleW
SetFilePointerEx
FindNextFileW
CreateDirectoryW
FindFirstFileW
FindClose
ReadConsoleW
SetEvent
InitializeCriticalSectionAndSpinCount
ResumeThread
SetHandleInformation
IsProcessorFeaturePresent
UnhandledExceptionFilter
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
GetOverlappedResult
CreateEventW
ReadFile
ExitProcess
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
DeleteFileW
MoveFileExW
RemoveDirectoryW
CreateSymbolicLinkW
CreateHardLinkW
SetFileAttributesW
CopyFileExW
RaiseException
RegisterWaitForSingleObject
UnregisterWaitEx
GetProcessId
PostQueuedCompletionStatus
SetConsoleCtrlHandler
SetConsoleTextAttribute
FileTimeToSystemTime
VirtualAlloc
VirtualFree
GetTickCount
FormatMessageA
GetSystemTime
SystemTimeToFileTime
GetFileSize
LocalFree
HeapDestroy
HeapCompact
DeleteFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
MultiByteToWideChar
HeapSize
HeapValidate
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
HeapCreate
AreFileApisANSI
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
GetLocaleInfoEx
IsDebuggerPresent
GetThreadContext
GetTimeZoneInformation
GetTempFileNameA
VerifyVersionInfoW
MapViewOfFileEx
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
QueryThreadCycleTime
GetThreadPriority
SetThreadPriority
SystemTimeToTzSpecificLocalTime
GetDateFormatEx
GetTimeFormatEx
ResetEvent
InitOnceExecuteOnce
FlsAlloc
FlsGetValue
FlsSetValue
SetUnhandledExceptionFilter
GetNumberOfConsoleInputEvents
WaitForMultipleObjects
SetConsoleCursorPosition
LockFileEx
SetConsoleMode
UnlockFile
CloseHandle
AcquireSRWLockExclusive
ConvertFiberToThread
GetNativeSystemInfo
GetDynamicTimeZoneInformation
GetUserGeoID
GetGeoInfoW
DuplicateHandle
VirtualQuery
CreateSemaphoreA
InitializeConditionVariable
SuspendThread
FindFirstFileExW

crypt32

CertCloseStore
CertGetEnhancedKeyUsage
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertOpenStore
CertFreeCertificateContext

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

advapi32

LookupPrivilegeValueW
EventWriteTransfer
EventSetInformation
RegQueryInfoKeyW
RegCloseKey
AdjustTokenPrivileges
SystemFunction036
RegOpenKeyExW
RegQueryValueExW
EventRegister
RegEnumKeyExW
OpenProcessToken

user32

CloseClipboard
MapVirtualKeyW
GetClipboardData
OpenClipboard

ws2_32

WSASocketW
getaddrinfo
recvfrom
sendto
freeaddrinfo
WSACleanup
getsockopt
getpeername
connect
accept
socket
WSAIoctl
setsockopt
WSAStartup
GetHostNameW
getsockname
ioctlsocket
WSAGetLastError
listen
bind
closesocket
WSASend
shutdown
send
recv

bcrypt

BCryptGenRandom

winmm

timeGetTime

dbghelp

SymSetOptions
SymSetSearchPathW
SymGetSearchPathW
SymGetModuleBase64
SymFunctionTableAccess64
StackWalk64
SymFromAddr
SymInitialize
SymGetLineFromAddr64

psapi

GetProcessMemoryInfo
GetPerformanceInfo

Exports

Exports

CrashForExceptionInNonABICompliantCodeRange
napi_acquire_threadsafe_function
napi_add_env_cleanup_hook
napi_add_finalizer
napi_adjust_external_memory
napi_async_destroy
napi_async_init
napi_call_function
napi_call_threadsafe_function
napi_cancel_async_work
napi_close_callback_scope
napi_close_escapable_handle_scope
napi_close_handle_scope
napi_coerce_to_bool
napi_coerce_to_number
napi_coerce_to_object
napi_coerce_to_string
napi_create_array
napi_create_array_with_length
napi_create_arraybuffer
napi_create_async_work
napi_create_bigint_int64
napi_create_bigint_uint64
napi_create_bigint_words
napi_create_buffer
napi_create_buffer_copy
napi_create_dataview
napi_create_date
napi_create_double
napi_create_error
napi_create_external
napi_create_external_arraybuffer
napi_create_external_buffer
napi_create_function
napi_create_int32
napi_create_int64
napi_create_object
napi_create_promise
napi_create_range_error
napi_create_reference
napi_create_string_latin1
napi_create_string_utf16
napi_create_string_utf8
napi_create_symbol
napi_create_threadsafe_function
napi_create_type_error
napi_create_typedarray
napi_create_uint32
napi_define_class
napi_define_properties
napi_delete_async_work
napi_delete_element
napi_delete_property
napi_delete_reference
napi_detach_arraybuffer
napi_escape_handle
napi_fatal_error
napi_fatal_exception
napi_get_all_property_names
napi_get_and_clear_last_exception
napi_get_array_length
napi_get_arraybuffer_info
napi_get_boolean
napi_get_buffer_info
napi_get_cb_info
napi_get_dataview_info
napi_get_date_value
napi_get_element
napi_get_global
napi_get_instance_data
napi_get_last_error_info
napi_get_named_property
napi_get_new_target
napi_get_node_version
napi_get_null
napi_get_property
napi_get_property_names
napi_get_prototype
napi_get_reference_value
napi_get_threadsafe_function_context
napi_get_typedarray_info
napi_get_undefined
napi_get_uv_event_loop
napi_get_value_bigint_int64
napi_get_value_bigint_uint64
napi_get_value_bigint_words
napi_get_value_bool
napi_get_value_double
napi_get_value_external
napi_get_value_int32
napi_get_value_int64
napi_get_value_string_latin1
napi_get_value_string_utf16
napi_get_value_string_utf8
napi_get_value_uint32
napi_get_version
napi_has_element
napi_has_named_property
napi_has_own_property
napi_has_property
napi_instanceof
napi_is_array
napi_is_arraybuffer
napi_is_buffer
napi_is_dataview
napi_is_date
napi_is_detached_arraybuffer
napi_is_error
napi_is_exception_pending
napi_is_promise
napi_is_typedarray
napi_make_callback
napi_module_register
napi_new_instance
napi_object_freeze
napi_object_seal
napi_open_callback_scope
napi_open_escapable_handle_scope
napi_open_handle_scope
napi_queue_async_work
napi_ref_threadsafe_function
napi_reference_ref
napi_reference_unref
napi_reject_deferred
napi_release_threadsafe_function
napi_remove_env_cleanup_hook
napi_remove_wrap
napi_resolve_deferred
napi_run_script
napi_set_element
napi_set_instance_data
napi_set_named_property
napi_set_property
napi_strict_equals
napi_throw
napi_throw_error
napi_throw_range_error
napi_throw_type_error
napi_typeof
napi_unref_threadsafe_function
napi_unwrap
napi_wrap
node_api_create_syntax_error
node_api_get_module_file_name
node_api_throw_syntax_error

Sections

.text
Size: 39.2MB - Virtual size: 39.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29.9MB - Virtual size: 29.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 187KB - Virtual size: 316KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 180KB - Virtual size: 179KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4a116919f367438e6f5eb6901ef89463

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

iphlpapi

kernel32

crypt32

shell32

ole32

advapi32

user32

ws2_32

bcrypt

winmm

dbghelp

psapi

Exports

Exports

Sections

.text Size: 39.2MB - Virtual size: 39.2MB

.rdata Size: 29.9MB - Virtual size: 29.9MB

.data Size: 187KB - Virtual size: 316KB

.pdata Size: 1.7MB - Virtual size: 1.7MB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 109KB - Virtual size: 108KB

.reloc Size: 180KB - Virtual size: 179KB

.text
Size: 39.2MB - Virtual size: 39.2MB

.rdata
Size: 29.9MB - Virtual size: 29.9MB

.data
Size: 187KB - Virtual size: 316KB

.pdata
Size: 1.7MB - Virtual size: 1.7MB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 109KB - Virtual size: 108KB

.reloc
Size: 180KB - Virtual size: 179KB