Static task
static1
General
-
Target
Horion.dll
-
Size
2.3MB
-
MD5
fb4b9712001eb291dc8353ab7f34e939
-
SHA1
eba5f6d3c7bc617a279d0baf60bd6d9a13c1cf7a
-
SHA256
48c1d75ac5fd6b87985d4a6f9816600c59f037fe1aa0fb246bd020044383fccf
-
SHA512
c74e51d5ab7158cd74d1cd33e364c5a4e49fdfdf22002de60e828b360a16f4960d5e20eb38040ab2c395fb8c0956152fc291cb9f49510f5c1fdae1a5723a89be
-
SSDEEP
49152:HfOIoW2qSVUlJQNlY3F7FXbfvx8lsRxe/n/zpkmdytLXviZkZsWfOql:MQ9+TzpUXDuVS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Horion.dll
Files
-
Horion.dll.dll windows:6 windows x64
a2909fa49a6cf3d30b8a4448e1dcc573
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
RaiseException
QueryPerformanceFrequency
QueryPerformanceCounter
FindResourceA
LoadResource
LockResource
SizeofResource
Sleep
FreeLibraryAndExitThread
CreateThread
ExitThread
DisableThreadLibraryCalls
VirtualProtect
GetModuleHandleA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
MultiByteToWideChar
GlobalLock
GlobalUnlock
GlobalAlloc
GlobalFree
K32GetModuleInformation
GetCurrentProcess
HeapCreate
HeapFree
HeapDestroy
OpenThread
ResumeThread
CloseHandle
HeapReAlloc
HeapAlloc
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
Thread32Next
GetLastError
SuspendThread
GetThreadContext
SetThreadContext
FlushInstructionCache
GetModuleHandleW
GetProcAddress
VirtualFree
GetSystemInfo
VirtualQuery
VirtualAlloc
InterlockedPushEntrySList
InterlockedFlushSList
RtlPcToFileHeader
SetLastError
TlsAlloc
RtlUnwindEx
LoadLibraryW
FormatMessageW
WriteConsoleW
HeapSize
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
SetEndOfFile
SetStdHandle
GetFileSizeEx
GetConsoleOutputCP
WriteFile
FlushFileBuffers
DeleteFileW
GetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
GetModuleFileNameW
ExitProcess
SetFilePointerEx
GetFileType
ReadConsoleW
GetConsoleMode
ReadFile
GetModuleHandleExW
RtlUnwind
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
user32
EmptyClipboard
OpenClipboard
GetClipboardData
CloseClipboard
SetClipboardData
ole32
CoCreateGuid
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateStringReference
api-ms-win-core-localization-l1-2-0
GetCPInfo
FormatMessageA
LCMapStringEx
GetLocaleInfoEx
api-ms-win-core-synch-l1-1-0
WaitForSingleObjectEx
InitializeSRWLock
DeleteCriticalSection
CreateEventW
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
TryAcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
InitializeCriticalSectionEx
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetStartupInfoW
api-ms-win-core-string-l1-1-0
CompareStringEx
GetStringTypeW
WideCharToMultiByte
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-file-l1-1-0
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
api-ms-win-core-file-l1-2-2
AreFileApisANSI
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-fibers-l1-1-0
FlsGetValue
FlsAlloc
FlsSetValue
FlsFree
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
oleaut32
SysStringLen
SetErrorInfo
GetErrorInfo
SysFreeString
SysAllocString
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 402KB - Virtual size: 402KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 601KB - Virtual size: 600KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ