Static task
static1
Behavioral task
behavioral1
Sample
curl.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
curl.exe
Resource
win10v2004-20231222-en
General
-
Target
curl.exe
-
Size
3.9MB
-
MD5
a3569bf06d73db9fbf4ab4fceb75b495
-
SHA1
ce86cdf772371603dabcc6059553acd1b1116161
-
SHA256
46728863a11d653b6c1ad6b0ca5c2f8a8212558da538c4c4a8d055871aa7304a
-
SHA512
2eef62d55ccd29a24b53ffdb71d89c10be42d663b9d29c078a561117be2246bae6f020e607ee68504ea5a9bc5621b6802fc1ab8f174bc0c0d0200fc5aa724c98
-
SSDEEP
98304:L6VqnUiTgItsIlV1Q1+0tBAJLv+lwfX/c2tj5d:AqnVcuv0kj5d
Malware Config
Signatures
Files
-
curl.exe.exe windows:4 windows x64 arch:x64
79e3d58649f9b107c43913d66b7c92dd
Code Sign
01Certificate
IssuerCN=curl-for-win Root CA,OU=curl-for-win Root CA,O=curl-for-winNot Before31/08/2018, 12:18Not After30/08/2021, 12:18SubjectCN=curl-for-win Code Signing Authority,OU=curl-for-win Code Signing Authority,O=curl-for-winaf:42:e4:09:5d:94:1d:14Certificate
IssuerCN=curl-for-win Root CA,OU=curl-for-win Root CA,O=curl-for-winNot Before31/08/2018, 12:18Not After31/08/2023, 12:18SubjectCN=curl-for-win Root CA,OU=curl-for-win Root CA,O=curl-for-winKey Usages
KeyUsageCertSign
KeyUsageCRLSign
e8:8b:7c:35:d2:fb:f8:4f:6c:34:d8:65:1d:d2:88:b2:89:b4:e9:99:3c:20:43:de:f0:1b:db:30:de:e4:23:adSigner
Actual PE Digeste8:8b:7c:35:d2:fb:f8:4f:6c:34:d8:65:1d:d2:88:b2:89:b4:e9:99:3c:20:43:de:f0:1b:db:30:de:e4:23:adDigest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
CryptAcquireContextA
CryptAcquireContextW
CryptCreateHash
CryptDestroyHash
CryptGenRandom
CryptGetHashParam
CryptHashData
CryptReleaseContext
DeregisterEventSource
RegisterEventSourceW
ReportEventW
crypt32
CertAddCertificateContextToStore
CertCloseStore
CertCreateCertificateChainEngine
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateContext
CertGetCertificateChain
CertGetNameStringA
CertOpenStore
CryptQueryObject
CryptStringToBinaryA
kernel32
CloseHandle
ConvertFiberToThread
ConvertThreadToFiber
CreateFiber
CreateFileA
CreateFileMappingA
CreateToolhelp32Snapshot
DeleteCriticalSection
DeleteFiber
EnterCriticalSection
ExpandEnvironmentStringsA
FindClose
FindFirstFileW
FindNextFileW
FormatMessageA
FormatMessageW
FreeLibrary
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentVariableA
GetEnvironmentVariableW
GetFileSizeEx
GetFileTime
GetFileType
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetStartupInfoA
GetStdHandle
GetSystemDirectoryA
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
GetTimeZoneInformation
GetVersion
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
MapViewOfFile
Module32First
Module32Next
MultiByteToWideChar
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
ReadConsoleA
ReadConsoleW
ReadFile
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SearchPathA
SetConsoleMode
SetFileTime
SetLastError
SetUnhandledExceptionFilter
Sleep
SleepEx
SwitchToFiber
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
VerSetConditionMask
VerifyVersionInfoA
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteConsoleW
WriteFile
msvcrt
__C_specific_handler
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthreadex
_cexit
_chmod
_chsize
_errno
_exit
_fileno
_fmode
_fstat64
_get_osfhandle
_getpid
_gmtime64
_initterm
_localtime64
_lseeki64
_onexit
_setmode
_stat64
_strdup
_vsnwprintf
_stricmp
_strnicmp
_strtoi64
_sys_nerr
_time64
_vsnprintf
_wfopen
abort
atoi
calloc
clearerr
exit
fclose
feof
ferror
fflush
fgets
fopen
fprintf
fputc
fputs
fread
free
fseek
ftell
fwrite
getc
getenv
islower
isprint
isspace
isupper
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
printf
putchar
puts
qsort
raise
realloc
rename
rewind
setbuf
setlocale
setvbuf
signal
sprintf
sscanf
strcat
strchr
strcmp
strcpy
strcspn
strerror
strlen
strncmp
strncpy
strpbrk
strrchr
strspn
strstr
strtok
strtol
strtoul
tolower
vfprintf
wcscpy
wcslen
wcsstr
_write
_strdup
_setmode
_read
_open
_mkdir
_isatty
_getch
_fileno
_close
_access
normaliz
IdnToAscii
IdnToUnicode
user32
FindWindowA
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
SendMessageA
wldap32
ber_free
ldap_bind_s
ldap_err2string
ldap_first_attribute
ldap_first_entry
ldap_get_dn
ldap_get_values_len
ldap_init
ldap_memfree
ldap_msgfree
ldap_next_attribute
ldap_next_entry
ldap_search_s
ldap_set_option
ldap_simple_bind_s
ldap_sslinit
ldap_unbind_s
ldap_value_free_len
ws2_32
WSACleanup
WSAGetLastError
WSAIoctl
WSASetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostbyname
gethostname
getnameinfo
getpeername
getsockname
getsockopt
htonl
htons
ioctlsocket
listen
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket
Sections
.text Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 862KB - Virtual size: 861KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 89KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 22KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 49B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ