curl[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

curl.exe
Size

453KB
MD5

a2f18dad6f7be95ed9fc7a37b7d94ff7
SHA1

b8bb581995daddf253fe65b44687469dc0e77f68
SHA256

6186dc591f4422d4c53ceb0bbf2ec1a412da13f2c3b96d542be160fe1ab25152
SHA512

d55ee81df6bbac35fca0ba1a7dc6c55d6ef57e3944f94898b533c8e4ce5ac1a06f571b0265e62e5bd65027b43fcc9ec00aa89d29d02a91c714f889001b58519f
SSDEEP

12288:fannhUCHfbsk30vuelbwxfG22h+l3iAV20Sd78:fanik3ZfT+bAVTSd78

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
curl.exe

Files

curl.exe
.exe windows x86

03c69b15d08bee4d800f3261e8b96408

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSASetLastError
getpeername
getsockname
socket
ntohs
connect
getsockopt
htons
setsockopt
recv
closesocket
WSACleanup
WSAStartup
inet_pton
WSACloseEvent
WSACreateEvent
WSAEventSelect
ioctlsocket
WSAResetEvent
send
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
gethostname
htonl
getaddrinfo
freeaddrinfo
accept
listen
recvfrom
sendto
__WSAFDIsSet
select
bind
WSAGetLastError
WSAIoctl

advapi32

CryptReleaseContext
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptAcquireContextA
CryptGetHashParam

crypt32

CryptDecodeObjectEx
CertOpenStore
CertFindCertificateInStore
CertFreeCertificateChainEngine
CertEnumCertificatesInStore
CryptStringToBinaryA
CertFreeCertificateContext
PFXImportCertStore
CertGetCertificateChain
CertAddCertificateContextToStore
CertFreeCertificateChain
CertGetNameStringA
CertFindExtension
CertCreateCertificateChainEngine
CertCloseStore
CryptQueryObject

api-ms-win-core-console-l2-1-0

GetConsoleScreenBufferInfo

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableA
GetStdHandle

api-ms-win-core-file-l1-1-0

SetEndOfFile
GetFileSizeEx
CreateFileA
ReadFile
SetFileTime
GetFileTime
GetFileType

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-console-l1-1-0

SetConsoleMode
GetConsoleMode
WriteConsoleW
SetConsoleCtrlHandler

api-ms-win-core-kernel32-legacy-l1-1-2

Module32Next
VerifyVersionInfoA
Module32First

api-ms-win-core-toolhelp-l1-1-0

CreateToolhelp32Snapshot

api-ms-win-core-errorhandling-l1-1-0

SetLastError
GetLastError

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processenvironment-l1-2-0

SearchPathA

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
LoadLibraryExW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryA
GetTickCount

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EnterCriticalSection
SleepEx
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileExA

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free
malloc
realloc
calloc

api-ms-win-crt-stdio-l1-1-0

_write
_read
fwrite
fclose
ftell
ferror
fseek
getc
fread
__stdio_common_vsscanf
fputs
puts
_close
fgets
_get_osfhandle
_isatty
fopen
_open
__stdio_common_vsprintf
feof
_set_fmode
_setmode
_fileno
fputc
__p__commode
_lseeki64
__acrt_iob_func
fflush

api-ms-win-crt-time-l1-1-0

strftime
_gmtime64
_localtime64
_time64

api-ms-win-crt-convert-l1-1-0

strtol
strtod
wcstombs
atoi
strtoll
strtoul

api-ms-win-crt-runtime-l1-1-0

terminate
_controlfp_s
_register_thread_local_exe_atexit_callback
_errno
_beginthreadex
abort
_c_exit
__p___argv
__sys_nerr
__sys_errlist
__p___argc
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_set_app_type
_initialize_onexit_table
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_narrow_environment
_configure_narrow_argv
strerror

api-ms-win-crt-string-l1-1-0

strspn
tolower
strncmp
isprint
isupper
wcsncmp
_strdup
strcspn
strtok
strpbrk
strncpy

api-ms-win-crt-filesystem-l1-1-0

_access
_unlink
_fstat64
_stat64
_mkdir

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-multibyte-l1-1-0

_mbschr
_mbscmp
_mbspbrk
_mbsnbcpy
_mbsnbcmp

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
setlocale

kernel32

GetCurrentProcess
IsDebuggerPresent
GetModuleHandleW
GetCurrentProcessId
GetCurrentThreadId
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
UnhandledExceptionFilter
InitializeSListHead
TerminateProcess
IsProcessorFeaturePresent

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwind

api-ms-win-core-processthreads-l1-1-0

TlsFree
TlsSetValue
TlsAlloc
TlsGetValue

api-ms-win-crt-math-l1-1-0

_fdopen
__setusermatherr

api-ms-win-crt-conio-l1-1-0

_getch

Sections

.text
Size: 328KB - Virtual size: 328KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 101KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

03c69b15d08bee4d800f3261e8b96408

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

advapi32

crypt32

api-ms-win-core-console-l2-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-2

api-ms-win-core-toolhelp-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-synch-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-locale-l1-1-0

kernel32

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-conio-l1-1-0

Sections

.text Size: 328KB - Virtual size: 328KB

.rdata Size: 101KB - Virtual size: 100KB

.data Size: 512B - Virtual size: 2KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 20KB - Virtual size: 20KB

.text
Size: 328KB - Virtual size: 328KB

.rdata
Size: 101KB - Virtual size: 100KB

.data
Size: 512B - Virtual size: 2KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 20KB - Virtual size: 20KB