haloce[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

haloce.exe
Size

2.3MB
MD5

b81d69fa635e0868062e43c9ab68abfe
SHA1

0bddc8e78cca61eebf4ac8b7121d56df3386564a
SHA256

84acb2778b0bde068641282b07865b9307a5b991345776902f2422135375642f
SHA512

d88eec4721edaf96ae13bc05245c36880e6a8a5c678b7d186c5042bbf7c0dd074d929b21c101cbd1cc2d1bae36e79b609c0cd68058ea3cd72f66e4f036c7969b
SSDEEP

49152:sSfxqoZPKkm9mDKPiFGUUAR66d6bY2iJwc4jHZ:szkOPiFyAR66Q02i2c

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
haloce.exe

Files

haloce.exe
.exe windows x86

f02b3d27cbe4ea75107cb8a4181af15a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

inet_ntoa
recvfrom
WSAGetLastError
setsockopt
sendto
socket
gethostname
WSAStartup
gethostbyname
inet_addr

dsound

ord9

winmm

timeEndPeriod
timeBeginPeriod

kernel32

SetLastError
ReadFileEx
SystemTimeToFileTime
CompareFileTime
SetFileTime
ReadFile
GetFileTime
GetSystemTime
WriteFile
GetOverlappedResult
ExitProcess
FreeLibrary
GetCurrentProcess
VirtualFree
GetProcAddress
VirtualAlloc
LoadLibraryA
GlobalMemoryStatus
SetErrorMode
QueryPerformanceCounter
GlobalAlloc
GetFileAttributesA
CreateDirectoryA
GlobalFree
QueryPerformanceFrequency
GetCurrentProcessId
GlobalReAlloc
GetCurrentThread
GetTickCount
FindFirstFileA
FindClose
FindNextFileA
FillConsoleOutputCharacterA
GetNumberOfConsoleInputEvents
WriteConsoleOutputCharacterA
ReadConsoleInputA
SetConsoleCursorPosition
GetStdHandle
WriteConsoleA
GetConsoleScreenBufferInfo
SetConsoleCursorInfo
FillConsoleOutputAttribute
GetConsoleCursorInfo
GetTimeFormatA
GetDateFormatA
VirtualQuery
GetLocalTime
GetModuleFileNameA
FormatMessageA
LocalFree
SetThreadLocale
GetThreadLocale
CopyFileA
DeleteFileA
GetDiskFreeSpaceExA
GlobalLock
GetACP
GlobalUnlock
LocalAlloc
GetCurrentDirectoryA
GetLastError
GetTempPathA
SetPriorityClass
GetPriorityClass
CreateProcessA
TerminateProcess
MultiByteToWideChar
GetModuleHandleA
GetCurrentThreadId
DuplicateHandle
RemoveDirectoryA
GetFileAttributesExA
SetFileAttributesA
WideCharToMultiByte
GetThreadPriority
LoadResource
FindResourceExA
LockResource
SizeofResource
FindResourceA
FindResourceW
GetSystemInfo
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
CompareStringA
GetStringTypeW
GetStringTypeA
IsValidCodePage
IsValidLocale
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InterlockedExchange
RaiseException
GetSystemTimeAsFileTime
GetStartupInfoA
GetCommandLineA
RtlUnwind
HeapReAlloc
FlushFileBuffers
SetHandleCount
GetFileType
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
LCMapStringA
LCMapStringW
HeapSize
GetTimeZoneInformation
GetOEMCP
GetCPInfo
UnhandledExceptionFilter
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
CreateEventA
WaitForSingleObjectEx
SleepEx
SetEvent
VirtualProtect
Sleep
CreateFileMappingA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
SetFilePointer
GetFileSize
CreateFileA
ExitThread
TerminateThread
CreateThread
ResumeThread
CloseHandle
ReleaseMutex
CreateMutexA
GetExitCodeThread
SetThreadPriority
WaitForSingleObject
CompareStringW
SetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
IsBadWritePtr
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetLocaleInfoW
GetVersionExA
SetEnvironmentVariableA
InitializeCriticalSection

vorbisfile

ov_clear
ov_crosslap
ov_open_callbacks
ov_read

user32

LoadStringA
GetParent
RemovePropA
SendMessageA
PtInRect
GetCapture
SetPropA
InvalidateRect
GetWindowLongA
GetDlgItem
EndDialog
IsDlgButtonChecked
ReleaseCapture
SetWindowTextA
EnableWindow
CallWindowProcA
DialogBoxIndirectParamA
DialogBoxParamA
SetDlgItemTextA
CreateDialogIndirectParamA
SetWindowPos
GetPropA
FindWindowA
CloseClipboard
PostQuitMessage
IsClipboardFormatAvailable
wsprintfA
GetClientRect
GetDoubleClickTime
GetForegroundWindow
GetClipboardData
DefWindowProcA
OpenClipboard
ValidateRect
DestroyWindow
SetActiveWindow
RegisterClassExA
SetForegroundWindow
LoadBitmapA
LoadIconA
SetFocus
GetDC
ShowCursor
SetCapture
ClientToScreen
GetWindowPlacement
SetWindowLongA
UnregisterClassA
CreateWindowExA
ReleaseDC
ShowWindow
AdjustWindowRect
MoveWindow
MsgWaitForMultipleObjects
GetCursorPos
GetWindowRect
GetDesktopWindow
GetKeyState
GetAsyncKeyState
GetActiveWindow
GetSystemMetrics
SetCursor
LoadCursorA
MessageBoxA
TranslateMessage
PeekMessageA
DispatchMessageA

gdi32

SetTextColor
CreateFontIndirectA
StretchBlt
GetObjectA
GetDeviceGammaRamp
SetDeviceGammaRamp
GetDeviceCaps
DeleteObject
CreateCompatibleDC
SelectObject

advapi32

OpenThreadToken
RegOpenKeyA
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
GetLengthSid
IsValidSecurityDescriptor
RegQueryValueExA
FreeSid
AddAccessAllowedAce
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegCreateKeyExA
OpenProcessToken
SetSecurityDescriptorGroup
AccessCheck
DuplicateToken
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
InitializeAcl
AllocateAndInitializeSid
SetSecurityDescriptorOwner

ole32

CoCreateInstance
StringFromGUID2
CoInitialize
CoUninitialize
CLSIDFromString

oleaut32

VariantInit
VariantClear

binkw32

_BinkSetSoundSystem@8
_BinkDoFrame@4
_BinkOpenDirectSound@4
_BinkCopyToBuffer@28
_BinkPause@8
_BinkNextFrame@4
_BinkOpen@8
_BinkWait@4
_BinkClose@4

wininet

InternetQueryOptionA

wsock32

__WSAFDIsSet
shutdown
ntohl
htonl
ntohs
htons
getsockname
closesocket
bind
select
connect
WSACleanup
inet_ntoa
recv
send

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 216KB - Virtual size: 215KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 152KB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f02b3d27cbe4ea75107cb8a4181af15a

Headers

File Characteristics

Imports

ws2_32

dsound

winmm

kernel32

vorbisfile

user32

gdi32

advapi32

ole32

oleaut32

binkw32

wininet

wsock32

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 216KB - Virtual size: 215KB

.data Size: 152KB - Virtual size: 2.0MB

.tls Size: 4KB - Virtual size: 9B

.rsrc Size: 60KB - Virtual size: 59KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 216KB - Virtual size: 215KB

.data
Size: 152KB - Virtual size: 2.0MB

.tls
Size: 4KB - Virtual size: 9B

.rsrc
Size: 60KB - Virtual size: 59KB