Static task
static1
General
-
Target
haloce.exe
-
Size
2.3MB
-
MD5
7c3fd3b07a6c41a4dbdbdba1b4442580
-
SHA1
3d0689e80a144292835f221acef93ddde5fae5a1
-
SHA256
7de68b02aa4d2ed521144db5f7d8ecdc2071dc7b2270f6a0c9b66a621c072a64
-
SHA512
902cf9103ddfd0961997fdb38957829e1e72f89e4c9b477e50e875335317a1b198126d90fbfefdc9af471cc46b84877fa394250e23f9513ab55fab9050516697
-
SSDEEP
24576:5qYeYDR6kuGNnQ6NOJlmUD3gMq1tdE2b7/LTrYwNSNQvq547NG36hqWVc0zbz5WW:5qUcVGNnQQTpvqyNwYYHSTjFAxUjvGW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource haloce.exe
Files
-
haloce.exe.exe windows:4 windows x86 arch:x86
Password: infected
7c2c2693650b2da7ce5e3ad1b804cf41
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualFree
GetProcAddress
VirtualAlloc
LoadLibraryA
GlobalMemoryStatus
SetErrorMode
QueryPerformanceCounter
GlobalAlloc
GetFileAttributesA
CreateDirectoryA
GlobalFree
QueryPerformanceFrequency
GetCurrentProcessId
GlobalReAlloc
GetCurrentThread
GetTickCount
FindFirstFileA
FindClose
FindNextFileA
FillConsoleOutputCharacterA
GetNumberOfConsoleInputEvents
WriteConsoleOutputCharacterA
ReadConsoleInputA
SetConsoleCursorPosition
GetStdHandle
WriteConsoleA
GetConsoleScreenBufferInfo
SetConsoleCursorInfo
FillConsoleOutputAttribute
GetConsoleCursorInfo
GetTimeFormatA
GetDateFormatA
VirtualQuery
GetLocalTime
GetModuleFileNameA
FormatMessageA
LocalFree
SetThreadLocale
GetThreadLocale
CopyFileA
DeleteFileA
GetDiskFreeSpaceExA
GlobalLock
GetACP
GlobalUnlock
LocalAlloc
GetCurrentDirectoryA
GetVersionExA
GetTempPathA
SetPriorityClass
GetPriorityClass
CreateProcessA
TerminateProcess
MultiByteToWideChar
GetModuleHandleA
GetCurrentThreadId
DuplicateHandle
RemoveDirectoryA
GetFileAttributesExA
SetFileAttributesA
WideCharToMultiByte
GetThreadPriority
LoadResource
LockResource
GetCurrentProcess
SizeofResource
FindResourceA
FindResourceW
GetSystemInfo
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
GetLocaleInfoW
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
IsBadWritePtr
HeapCreate
HeapDestroy
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
SetStdHandle
CompareStringW
CompareStringA
GetStringTypeW
GetStringTypeA
IsValidCodePage
IsValidLocale
SetEnvironmentVariableA
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
UnhandledExceptionFilter
GetCPInfo
GetOEMCP
GetTimeZoneInformation
HeapSize
LCMapStringW
LCMapStringA
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
GetFileType
SetHandleCount
FlushFileBuffers
HeapReAlloc
RtlUnwind
GetCommandLineA
GetStartupInfoA
GetSystemTimeAsFileTime
RaiseException
InterlockedExchange
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
ReadFileEx
SetLastError
GetLastError
CreateEventA
WaitForSingleObjectEx
SleepEx
SetEvent
VirtualProtect
Sleep
CreateFileMappingA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
SetFilePointer
GetFileSize
CreateFileA
ExitThread
FreeLibrary
ExitProcess
GetOverlappedResult
WriteFile
GetSystemTime
GetFileTime
ReadFile
SetFileTime
CompareFileTime
SystemTimeToFileTime
TerminateThread
CreateThread
ResumeThread
CloseHandle
ReleaseMutex
CreateMutexA
GetExitCodeThread
SetThreadPriority
FindResourceExA
WaitForSingleObject
user32
GetPropA
LoadStringA
GetParent
RemovePropA
SendMessageA
PtInRect
GetCapture
SetPropA
InvalidateRect
GetWindowLongA
GetDlgItem
SetCapture
IsDlgButtonChecked
ReleaseCapture
SetWindowTextA
EnableWindow
DispatchMessageA
PeekMessageA
TranslateMessage
MessageBoxA
LoadCursorA
SetCursor
ClientToScreen
EndDialog
CallWindowProcA
DialogBoxIndirectParamA
DialogBoxParamA
SetDlgItemTextA
CreateDialogIndirectParamA
SetWindowPos
GetWindowPlacement
FindWindowA
CloseClipboard
PostQuitMessage
IsClipboardFormatAvailable
wsprintfA
GetClientRect
GetDoubleClickTime
GetForegroundWindow
GetClipboardData
DefWindowProcA
OpenClipboard
ValidateRect
DestroyWindow
SetActiveWindow
RegisterClassExA
SetForegroundWindow
LoadBitmapA
LoadIconA
SetFocus
GetDC
ShowCursor
SetWindowLongA
UnregisterClassA
ReleaseDC
ShowWindow
AdjustWindowRect
MoveWindow
MsgWaitForMultipleObjects
GetCursorPos
GetWindowRect
GetDesktopWindow
GetKeyState
GetAsyncKeyState
GetActiveWindow
GetSystemMetrics
CreateWindowExA
gdi32
CreateFontIndirectA
StretchBlt
GetObjectA
GetDeviceGammaRamp
SetDeviceGammaRamp
GetDeviceCaps
DeleteObject
SelectObject
CreateCompatibleDC
SetTextColor
advapi32
SetSecurityDescriptorGroup
OpenProcessToken
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
AccessCheck
DuplicateToken
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
InitializeAcl
AllocateAndInitializeSid
SetSecurityDescriptorOwner
AddAccessAllowedAce
FreeSid
IsValidSecurityDescriptor
GetLengthSid
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
CryptCreateHash
CryptDestroyHash
CryptHashData
RegOpenKeyA
OpenThreadToken
ole32
CoCreateInstance
CoInitialize
StringFromGUID2
CLSIDFromString
CoUninitialize
oleaut32
VariantClear
VariantInit
Sections
.text Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 216KB - Virtual size: 215KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 152KB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ