startkiller-portable[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

startkiller-portable.zip
Size

194KB
MD5

ed464752b3875372ab6c5ab3b06c4bf1
SHA1

d74d54e598130bc9ffd84bd1b31514dc93268a6a
SHA256

c72162d58c18a94a611d0d48386ff227ba1f14615304bc10ac39ab04c259d1c7
SHA512

e60656cfa70c639924154f03e246fc31db3154ac2b94f4550e8043ca9e9a405495db6e1b08ca0277984b5c1758d213ca83a8c2cde97f3799e2a8b9463fa22d28
SSDEEP

3072:uwglsJ8BCRtSXLk8piH57dcrPt4PVI0kJp6ZTIkuWBaGgJ/CokuD6OryLUzkuW:uw8ERtIQ1dHVFkP6ZTIdWgGiaumnU1W

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/startkiller-portable/32/StartKiller.exe
unpack001/startkiller-portable/32/ashook.dll
unpack001/startkiller-portable/64/StartKiller.exe
unpack001/startkiller-portable/64/ashook.dll

Files

startkiller-portable.zip
.zip
startkiller-portable/32/StartKiller.exe
.exe windows:6 windows x86

a066edca1e331609212cbba1398d44dd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ashook

DisableStartMenu
HookEnd
HookStart
FindTaskBar

comctl32

ord17

kernel32

lstrlenW
GetPrivateProfileIntW
WritePrivateProfileStringW
FreeResource
LoadResource
LockResource
FindResourceW
VerSetConditionMask
GetCurrentThreadId
OpenThread
TerminateThread
VerifyVersionInfoW
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
LCMapStringW
HeapSize
GetStringTypeW
HeapReAlloc
OutputDebugStringW
LoadLibraryExW
lstrcatW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
GetCurrentProcess
Sleep
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameW
lstrcmpiA
CreateMutexW
GetLastError
CloseHandle
lstrcpyW
WriteFile
GetModuleFileNameA
GetStartupInfoW
DeleteCriticalSection
GetFileType
CreateFileW
GetStdHandle
RtlUnwind
GetCommandLineA
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
HeapAlloc
EncodePointer
DecodePointer
RaiseException
SetLastError
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap

user32

GetWindowThreadProcessId
FindWindowW
GetForegroundWindow
IsWindowVisible
ShowWindow
AttachThreadInput
SetWindowLongW
GetWindowLongW
EndDialog
DialogBoxIndirectParamW
SendMessageW
LoadIconW
LoadCursorW
GetCursorPos
RemovePropW
GetPropW
SetPropW
SetForegroundWindow
TrackPopupMenu
InsertMenuW
CreatePopupMenu
DestroyWindow
IsWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
PostQuitMessage
DefWindowProcW
RegisterHotKey
MessageBoxW
PostMessageW
DispatchMessageW
TranslateMessage
GetMessageW
RegisterWindowMessageW
GetWindowRect
SetWindowTextW
EnableWindow
SendDlgItemMessageW
GetDlgItem
MoveWindow
wsprintfW
LoadStringW
SetMenuDefaultItem

advapi32

RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey

shell32

Shell_NotifyIconW
ShellExecuteW

shlwapi

PathAddBackslashW
PathFileExistsW
PathRemoveFileSpecW

Sections

.text
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
startkiller-portable/32/ashook.dll
.dll windows:6 windows x86

cc1c68c0fb415310b6d2aa52c30b9957

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

Sleep
GlobalAddAtomW
OutputDebugStringA
GetLastError
SetLastError
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
LoadLibraryA
LoadLibraryW
CloseHandle
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
VerifyVersionInfoW
LCMapStringW
HeapSize
OutputDebugStringW
GetStringTypeW
HeapReAlloc
HeapAlloc
LoadLibraryExW
WriteFile
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
LeaveCriticalSection
lstrcmpiW
VerSetConditionMask
RaiseException
FreeLibrary
LoadLibraryExA
GetCommandLineA
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
RtlUnwind
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EnterCriticalSection
CreateFileW

user32

GetMonitorInfoW
MonitorFromWindow
GetDesktopWindow
FillRect
MapWindowPoints
GetWindowRect
GetClientRect
GetSystemMetrics
MoveWindow
ShowWindow
DefWindowProcW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetWindowThreadProcessId
RemovePropW
GetPropW
SetPropW
InvalidateRect
UpdateWindow
IsWindow
SendMessageW
RegisterWindowMessageW
GetClassNameW
EnumWindows
FindWindowExW
EnumChildWindows
GetParent

gdi32

CreateSolidBrush
DeleteObject

Exports

Exports

DisableStartMenu
FindTaskBar
HookEnd
HookStart
IsStartMenuDisabled

Sections

.text
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.IdleUI
Size: 512B - Virtual size: 14B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
startkiller-portable/32/startkiller.ini
startkiller-portable/64/StartKiller.exe
.exe windows:6 windows x64

e5cef021439e1098837809d2832fd609

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ashook

HookEnd
HookStart
DisableStartMenu
FindTaskBar

comctl32

ord17

kernel32

lstrlenW
GetPrivateProfileIntW
WritePrivateProfileStringW
FreeResource
LoadResource
LockResource
FindResourceW
VerSetConditionMask
GetCurrentThreadId
OpenThread
TerminateThread
VerifyVersionInfoW
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
LCMapStringW
GetModuleFileNameW
HeapSize
GetStringTypeW
HeapReAlloc
OutputDebugStringW
lstrcatW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
GetCurrentProcess
Sleep
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
lstrcmpiA
CreateMutexW
GetLastError
CloseHandle
LoadLibraryExW
lstrcpyW
GetCurrentProcessId
CreateFileW
QueryPerformanceCounter
WriteFile
GetModuleFileNameA
GetStartupInfoW
DeleteCriticalSection
RtlLookupFunctionEntry
RtlUnwindEx
GetCommandLineA
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
HeapAlloc
EncodePointer
DecodePointer
RtlPcToFileHeader
RaiseException
SetLastError
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType

user32

GetWindowThreadProcessId
FindWindowW
GetForegroundWindow
IsWindowVisible
ShowWindow
AttachThreadInput
SetWindowLongPtrW
GetWindowLongPtrW
EndDialog
DialogBoxIndirectParamW
SendMessageW
LoadIconW
LoadCursorW
GetCursorPos
RemovePropW
GetPropW
SetPropW
SetForegroundWindow
TrackPopupMenu
InsertMenuW
CreatePopupMenu
DestroyWindow
IsWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
PostQuitMessage
DefWindowProcW
RegisterHotKey
MessageBoxW
PostMessageW
DispatchMessageW
TranslateMessage
GetMessageW
RegisterWindowMessageW
GetWindowRect
SetWindowTextW
EnableWindow
SendDlgItemMessageW
GetDlgItem
MoveWindow
wsprintfW
LoadStringW
SetMenuDefaultItem

advapi32

RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey

shell32

ShellExecuteW
Shell_NotifyIconW

shlwapi

PathAddBackslashW
PathFileExistsW
PathRemoveFileSpecW

Sections

.text
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
startkiller-portable/64/ashook.dll
.dll windows:6 windows x64

693eb7549802126e0ae7e95f67093026

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

Sleep
GlobalAddAtomW
OutputDebugStringA
GetLastError
SetLastError
GetModuleFileNameW
GetModuleHandleExW
GetProcAddress
LoadLibraryW
CreateActCtxW
ActivateActCtx
DeactivateActCtx
FindActCtxSectionStringW
QueryActCtxW
CloseHandle
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
VerifyVersionInfoW
LCMapStringW
HeapSize
OutputDebugStringW
GetStringTypeW
HeapReAlloc
HeapAlloc
LoadLibraryExW
WriteFile
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
LeaveCriticalSection
lstrcmpiW
FlushFileBuffers
VerSetConditionMask
RaiseException
FreeLibrary
LoadLibraryExA
RtlUnwindEx
GetCommandLineA
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
DecodePointer
ExitProcess
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
EnterCriticalSection
CreateFileW

user32

GetMonitorInfoW
MonitorFromWindow
GetDesktopWindow
FillRect
MapWindowPoints
GetWindowRect
GetClientRect
GetSystemMetrics
MoveWindow
ShowWindow
DefWindowProcW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetWindowThreadProcessId
RemovePropW
GetPropW
SetPropW
InvalidateRect
UpdateWindow
IsWindow
SendMessageW
RegisterWindowMessageW
GetClassNameW
EnumWindows
FindWindowExW
EnumChildWindows
GetParent

gdi32

CreateSolidBrush
DeleteObject

Exports

Exports

DisableStartMenu
FindTaskBar
HookEnd
HookStart
IsStartMenuDisabled

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.IdleUI
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
startkiller-portable/64/startkiller.ini
startkiller-portable/readme.txt

Sharing

General

Malware Config

Signatures

Files

a066edca1e331609212cbba1398d44dd

Headers

DLL Characteristics

File Characteristics

Imports

ashook

comctl32

kernel32

user32

advapi32

shell32

shlwapi

Sections

.text Size: 51KB - Virtual size: 50KB

.rdata Size: 24KB - Virtual size: 23KB

.data Size: 4KB - Virtual size: 12KB

.rsrc Size: 31KB - Virtual size: 31KB

cc1c68c0fb415310b6d2aa52c30b9957

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

Exports

Exports

Sections

.text Size: 47KB - Virtual size: 46KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 4KB - Virtual size: 11KB

.IdleUI Size: 512B - Virtual size: 14B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 3KB

e5cef021439e1098837809d2832fd609

Headers

DLL Characteristics

File Characteristics

Imports

ashook

comctl32

kernel32

user32

advapi32

shell32

shlwapi

Sections

.text Size: 57KB - Virtual size: 57KB

.rdata Size: 34KB - Virtual size: 33KB

.data Size: 6KB - Virtual size: 14KB

.pdata Size: 3KB - Virtual size: 3KB

.rsrc Size: 31KB - Virtual size: 31KB

693eb7549802126e0ae7e95f67093026

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

Exports

Exports

Sections

.text Size: 50KB - Virtual size: 50KB

.rdata Size: 28KB - Virtual size: 27KB

.data Size: 5KB - Virtual size: 14KB

.pdata Size: 3KB - Virtual size: 2KB

.IdleUI Size: 512B - Virtual size: 20B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 51KB - Virtual size: 50KB

.rdata
Size: 24KB - Virtual size: 23KB

.data
Size: 4KB - Virtual size: 12KB

.rsrc
Size: 31KB - Virtual size: 31KB

.text
Size: 47KB - Virtual size: 46KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 4KB - Virtual size: 11KB

.IdleUI
Size: 512B - Virtual size: 14B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 57KB - Virtual size: 57KB

.rdata
Size: 34KB - Virtual size: 33KB

.data
Size: 6KB - Virtual size: 14KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 31KB - Virtual size: 31KB

.text
Size: 50KB - Virtual size: 50KB

.rdata
Size: 28KB - Virtual size: 27KB

.data
Size: 5KB - Virtual size: 14KB

.pdata
Size: 3KB - Virtual size: 2KB

.IdleUI
Size: 512B - Virtual size: 20B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB