curl[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

curl.exe
Size

587KB
MD5

c84486b75d148bde935e7f8f4084a741
SHA1

b41e5ad102f2e599cf8c2fc60219fc1259482387
SHA256

6cf60c768a7377f7c4842c14c3c4d416480a7044a7a5a72b61ff142a796273ec
SHA512

7da57a30ee7a49c04e92dd06be3fef3c015ba1e9b7547a3784637fbb7d1537c65a210351b7e1ad5f1569124a475454b8d81ce5242e5f27893c5126ab39bfac1b
SSDEEP

12288:H8HFkQOjUdJj4nJBDQAy3AwC1aIzwIeLJCnqadoC:aZd9eJBDjuAwYiI4MnqIoC

Score

1^/10

Malware Config

Signatures

Files

curl.exe
.exe windows:6 windows x64 arch:x64

bbdb9c75d95f84296d0fce2e933932e2

Code Sign

33:00:00:03:84:d9:68:7d:66:cc:75:4b:a1:00:00:00:00:03:84
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13/07/2023, 23:45

Not After

15/09/2024, 23:45

Subject

CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5c:cd:8b:64:65:4c:db:54:9a:b5:3c:49:38:44:22:56:f5:9a:8a:c3:3a:83:f4:de:4f:92:26:52:c2:b0:b8:9f
Signer

Actual PE Digest

5c:cd:8b:64:65:4c:db:54:9a:b5:3c:49:38:44:22:56:f5:9a:8a:c3:3a:83:f4:de:4f:92:26:52:c2:b0:b8:9f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-core-console-l2-1-0

GetConsoleScreenBufferInfo

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle
GetEnvironmentVariableA
SearchPathW

api-ms-win-core-file-l1-1-0

SetFileTime
CreateFileW
GetFileType
ReadFile
GetFileTime
GetFileSizeEx
SetEndOfFile

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-console-l1-1-0

GetConsoleMode
WriteConsoleW
SetConsoleCtrlHandler
SetConsoleMode

api-ms-win-core-toolhelp-l1-1-0

CreateToolhelp32Snapshot
Module32FirstW
Module32NextW

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleA
GetProcAddress
FreeLibrary
GetModuleHandleW
LoadLibraryExW
GetModuleFileNameA

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW
GetTickCount

api-ms-win-core-synch-l1-1-0

SleepEx
EnterCriticalSection
DeleteCriticalSection
ReleaseSRWLockExclusive
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
AcquireSRWLockExclusive
LeaveCriticalSection
WaitForSingleObjectEx

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

ws2_32

WSAEnumNetworkEvents
getsockopt
WSAWaitForMultipleEvents
send
WSAResetEvent
WSAEventSelect
WSACreateEvent
WSACloseEvent
ioctlsocket
inet_pton
gethostname
getaddrinfo
WSAStartup
freeaddrinfo
htonl
accept
WSACleanup
ntohs
WSASetLastError
WSAGetLastError
listen
recvfrom
sendto
bind
closesocket
getpeername
getsockname
connect
setsockopt
WSAIoctl
htons
socket
select
__WSAFDIsSet
recv
inet_ntop

api-ms-win-core-localization-l1-2-0

FormatMessageW
IdnToAscii
IdnToUnicode

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

bcrypt

BCryptGenRandom

api-ms-win-security-cryptoapi-l1-1-0

CryptAcquireContextW
CryptHashData
CryptReleaseContext
CryptDestroyHash
CryptGetHashParam
CryptCreateHash

crypt32

CertCloseStore
CertFreeCertificateContext
CertEnumCertificatesInStore
CertFindCertificateInStore
CertOpenStore
CryptStringToBinaryW
CryptDecodeObjectEx
CertGetCertificateChain
CertFreeCertificateChainEngine
CertAddCertificateContextToStore
CryptQueryObject
CertFreeCertificateChain
CertGetNameStringW
CertFindExtension
CertCreateCertificateChainEngine
PFXImportCertStore

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe

api-ms-win-crt-heap-l1-1-0

calloc
realloc
free
malloc
_set_new_mode

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
fflush
fwrite
fputs
_read
_write
_close
_lseeki64
_get_osfhandle
_isatty
fputc
_fseeki64
_set_fmode
_wfopen
_wopen
__stdio_common_vsprintf
freopen
feof
fgets
__p__commode
puts
__stdio_common_vsscanf
fread
getc
fseek
ferror
ftell
fclose
_fileno
_setmode

api-ms-win-crt-time-l1-1-0

_gmtime64
_time64
_localtime64
strftime

api-ms-win-crt-convert-l1-1-0

strtoul
atoi
strtol
strtod
wcstombs
strtoll

api-ms-win-crt-runtime-l1-1-0

__p___wargv
__p___argc
_beginthreadex
_initialize_onexit_table
_exit
_c_exit
_register_onexit_function
__sys_errlist
_initterm_e
_register_thread_local_exe_atexit_callback
_get_initial_wide_environment
terminate
_initterm
exit
strerror
_crt_atexit
_errno
_cexit
abort
_seh_filter_exe
_set_app_type
__sys_nerr
_configure_wide_argv
_initialize_wide_environment

api-ms-win-crt-string-l1-1-0

strcmp
strtok
_stricmp
wcsncmp
wcsncpy
wcspbrk
strspn
_strdup
_wcsdup
wcscmp
strcspn
strncmp
strncpy
strpbrk

api-ms-win-crt-filesystem-l1-1-0

_fstat64
_mkdir
_unlink
_wstat64
_waccess

api-ms-win-crt-locale-l1-1-0

setlocale
_configthreadlocale

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-utility-l1-1-0

qsort

kernel32

GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
InitializeSListHead
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
TerminateProcess

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwindEx

api-ms-win-core-processthreads-l1-1-0

TlsGetValue
TlsSetValue
TlsFree
TlsAlloc

api-ms-win-crt-math-l1-1-0

__setusermatherr
_fdopen

api-ms-win-crt-conio-l1-1-0

_getch

Sections

.text
Size: 413KB - Virtual size: 413KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 141KB - Virtual size: 141KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bbdb9c75d95f84296d0fce2e933932e2

Code Sign

33:00:00:03:84:d9:68:7d:66:cc:75:4b:a1:00:00:00:00:03:84Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

5c:cd:8b:64:65:4c:db:54:9a:b5:3c:49:38:44:22:56:f5:9a:8a:c3:3a:83:f4:de:4f:92:26:52:c2:b0:b8:9fSigner

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-core-console-l2-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-toolhelp-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-1

ws2_32

api-ms-win-core-localization-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

bcrypt

api-ms-win-security-cryptoapi-l1-1-0

crypt32

api-ms-win-core-file-l2-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-utility-l1-1-0

kernel32

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-conio-l1-1-0

Sections

.text Size: 413KB - Virtual size: 413KB

.rdata Size: 141KB - Virtual size: 141KB

.data Size: 2KB - Virtual size: 6KB

.pdata Size: 12KB - Virtual size: 11KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 4KB

33:00:00:03:84:d9:68:7d:66:cc:75:4b:a1:00:00:00:00:03:84
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

5c:cd:8b:64:65:4c:db:54:9a:b5:3c:49:38:44:22:56:f5:9a:8a:c3:3a:83:f4:de:4f:92:26:52:c2:b0:b8:9f
Signer

.text
Size: 413KB - Virtual size: 413KB

.rdata
Size: 141KB - Virtual size: 141KB

.data
Size: 2KB - Virtual size: 6KB

.pdata
Size: 12KB - Virtual size: 11KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 4KB