curl[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

curl.exe
Size

519KB
MD5

98e0d0ca9b2da1678a02c5836a14f1a6
SHA1

eb74009edd352d52479abcbc973e1dd03d919540
SHA256

ec8bf6762f75fdd8254e8e22fbd3ce9de6015939d9875160ada0c00f8374674e
SHA512

82d54d332f87b19e727bff438d059fd7f8733f3c1889153807bdb624ac1166e4419079e2fd8674851d6854a775d34451e955aac2e1559316d795dcdfe692bd34
SSDEEP

12288:NcrhyA3OM9IRzDZXWM6upB+YOewouArnI5xnGpT+IZ3:NclyPDzGMFzOewoIbnG5

Score

1^/10

Malware Config

Signatures

Files

curl.exe
.exe windows:6 windows x86

b4bbf9ba116cea5e9e5a5e0c3c55a247

Code Sign

33:00:00:03:84:d9:68:7d:66:cc:75:4b:a1:00:00:00:00:03:84
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13-07-2023 23:45

Not After

15-09-2024 23:45

Subject

CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c3:3b:5c:b3:44:bf:9e:90:a1:ad:35:4b:ec:20:22:8f:19:da:3a:8d:ca:d5:52:4d:0c:e6:77:4a:a7:94:45:cc
Signer

Actual PE Digest

c3:3b:5c:b3:44:bf:9e:90:a1:ad:35:4b:ec:20:22:8f:19:da:3a:8d:ca:d5:52:4d:0c:e6:77:4a:a7:94:45:cc

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

api-ms-win-core-console-l2-1-0

GetConsoleScreenBufferInfo

api-ms-win-core-processenvironment-l1-1-0

SearchPathW
GetStdHandle
GetEnvironmentVariableA

api-ms-win-core-file-l1-1-0

GetFileTime
CreateFileW
SetFileTime
GetFileType
GetFileSizeEx
SetEndOfFile
ReadFile

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-console-l1-1-0

GetConsoleMode
SetConsoleMode
SetConsoleCtrlHandler
WriteConsoleW

api-ms-win-core-toolhelp-l1-1-0

Module32FirstW
CreateToolhelp32Snapshot
Module32NextW

api-ms-win-core-errorhandling-l1-1-0

SetLastError
GetLastError

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleW
GetModuleFileNameA
GetModuleHandleA
LoadLibraryExW
FreeLibrary

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetTickCount

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionEx
DeleteCriticalSection
ReleaseSRWLockExclusive
InitializeCriticalSectionAndSpinCount
AcquireSRWLockExclusive
LeaveCriticalSection
SleepEx
WaitForSingleObjectEx
EnterCriticalSection

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

ws2_32

getsockname
inet_ntop
inet_pton
sendto
getsockopt
WSAWaitForMultipleEvents
send
WSAResetEvent
WSAEventSelect
WSACreateEvent
WSACloseEvent
ioctlsocket
select
__WSAFDIsSet
recvfrom
WSAStartup
recv
accept
WSAEnumNetworkEvents
WSACleanup
ntohs
WSASetLastError
WSAGetLastError
getpeername
connect
gethostname
bind
closesocket
getaddrinfo
freeaddrinfo
htonl
setsockopt
WSAIoctl
htons
socket
listen

api-ms-win-core-localization-l1-2-0

IdnToAscii
FormatMessageW
IdnToUnicode

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

bcrypt

BCryptGenRandom

api-ms-win-security-cryptoapi-l1-1-0

CryptHashData
CryptAcquireContextW
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
CryptCreateHash

crypt32

CertCloseStore
CertGetCertificateChain
CertFreeCertificateChainEngine
CertAddCertificateContextToStore
CryptQueryObject
CertFreeCertificateContext
CertFreeCertificateChain
CertGetNameStringW
CertFindExtension
PFXImportCertStore
CertCreateCertificateChainEngine
CryptDecodeObjectEx
CertFindCertificateInStore
CertOpenStore
CertEnumCertificatesInStore
CryptStringToBinaryW

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe

api-ms-win-crt-heap-l1-1-0

calloc
malloc
free
realloc
_set_new_mode

api-ms-win-crt-stdio-l1-1-0

_write
_read
_close
ftell
_get_osfhandle
_lseeki64
ferror
_isatty
_setmode
fputs
fwrite
__acrt_iob_func
fputc
fseek
getc
fread
__stdio_common_vsscanf
_fileno
puts
__p__commode
fgets
feof
freopen
_fseeki64
_set_fmode
__stdio_common_vsprintf
_wfopen
_wopen
fclose
fflush

api-ms-win-crt-time-l1-1-0

_localtime64
_time64
_gmtime64
strftime

api-ms-win-crt-convert-l1-1-0

strtoll
strtol
strtod
atoi
wcstombs
strtoul

api-ms-win-crt-runtime-l1-1-0

__sys_nerr
__sys_errlist
abort
_controlfp_s
terminate
_beginthreadex
_register_thread_local_exe_atexit_callback
_c_exit
__p___wargv
__p___argc
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_errno
strerror

api-ms-win-crt-string-l1-1-0

strncmp
wcspbrk
_wcsdup
strspn
strncpy
strpbrk
_stricmp
_strdup
wcsncmp
wcsncpy
strcspn
strtok

api-ms-win-crt-filesystem-l1-1-0

_fstat64
_waccess
_mkdir
_wstat64
_unlink

api-ms-win-crt-locale-l1-1-0

setlocale
_configthreadlocale

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-utility-l1-1-0

qsort

kernel32

GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess
SetUnhandledExceptionFilter
GetCurrentProcess
UnhandledExceptionFilter
GetCurrentProcessId
IsProcessorFeaturePresent
IsDebuggerPresent

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwind

api-ms-win-core-processthreads-l1-1-0

TlsGetValue
TlsFree
TlsSetValue
TlsAlloc

api-ms-win-crt-math-l1-1-0

_fdopen
__setusermatherr

api-ms-win-crt-conio-l1-1-0

_getch

Sections

.text
Size: 371KB - Virtual size: 370KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b4bbf9ba116cea5e9e5a5e0c3c55a247

Code Sign

33:00:00:03:84:d9:68:7d:66:cc:75:4b:a1:00:00:00:00:03:84Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

c3:3b:5c:b3:44:bf:9e:90:a1:ad:35:4b:ec:20:22:8f:19:da:3a:8d:ca:d5:52:4d:0c:e6:77:4a:a7:94:45:ccSigner

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-core-console-l2-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-toolhelp-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-1

ws2_32

api-ms-win-core-localization-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

bcrypt

api-ms-win-security-cryptoapi-l1-1-0

crypt32

api-ms-win-core-file-l2-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-utility-l1-1-0

kernel32

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-conio-l1-1-0

Sections

.text Size: 371KB - Virtual size: 370KB

.rdata Size: 111KB - Virtual size: 111KB

.data Size: 1KB - Virtual size: 4KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 22KB - Virtual size: 22KB

33:00:00:03:84:d9:68:7d:66:cc:75:4b:a1:00:00:00:00:03:84
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

c3:3b:5c:b3:44:bf:9e:90:a1:ad:35:4b:ec:20:22:8f:19:da:3a:8d:ca:d5:52:4d:0c:e6:77:4a:a7:94:45:cc
Signer

.text
Size: 371KB - Virtual size: 370KB

.rdata
Size: 111KB - Virtual size: 111KB

.data
Size: 1KB - Virtual size: 4KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 22KB - Virtual size: 22KB