curl[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

curl.exe
Size

511KB
MD5

05de2eb0889d77d447bca7bd597819cf
SHA1

f2a6a42a85d97473dd51921b8ee1147b8983df15
SHA256

3a6e75332364b4c2ce8336ce0e4127a199c0758b09da1e97d990214ef2d559ca
SHA512

b04a67e612986f06df468906a068b17a17affc5fadd72127981f4ecd6eb5fbeaf183959218e0849fe8deb86ec8f2b6461586c4225002b31c8f321e2d46173cab
SSDEEP

12288:EHW89sXmx3v9mq1oaiil+t22YikLrAXYfjTintYMRo3mPAVTKSyb0S:P8qWxf9H1n0Ya5AV2Syb0S

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
curl.exe

Files

curl.exe
.exe windows:6 windows x64 arch:x64

9e2d88810eaf277296e0e26b4cc3e67b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

curl.pdb

Imports

ws2_32

getsockname
socket
ntohs
connect
getsockopt
htons
setsockopt
recv
WSAGetLastError
WSASetLastError
WSAStartup
inet_pton
WSACloseEvent
WSACreateEvent
WSAEventSelect
WSAResetEvent
send
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
ioctlsocket
closesocket
WSAIoctl
getpeername
gethostname
htonl
getaddrinfo
freeaddrinfo
accept
listen
recvfrom
sendto
__WSAFDIsSet
select
WSACleanup
bind

advapi32

CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptAcquireContextA
CryptReleaseContext

crypt32

CertGetCertificateChain
CryptDecodeObjectEx
CertOpenStore
CertFindCertificateInStore
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CryptStringToBinaryA
CertFreeCertificateContext
PFXImportCertStore
CertFreeCertificateChainEngine
CryptQueryObject
CertFreeCertificateChain
CertGetNameStringA
CertFindExtension
CertCreateCertificateChainEngine
CertCloseStore

api-ms-win-core-console-l2-1-0

GetConsoleScreenBufferInfo

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableA
GetStdHandle

api-ms-win-core-file-l1-1-0

GetFileType
ReadFile
GetFileTime
SetFileTime
SetEndOfFile
CreateFileA
GetFileSizeEx

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-console-l1-1-0

SetConsoleMode
WriteConsoleW
GetConsoleMode
SetConsoleCtrlHandler

api-ms-win-core-kernel32-legacy-l1-1-2

Module32First
Module32Next
VerifyVersionInfoA

api-ms-win-core-toolhelp-l1-1-0

CreateToolhelp32Snapshot

api-ms-win-core-errorhandling-l1-1-0

SetLastError
GetLastError

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processenvironment-l1-2-0

SearchPathA

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
LoadLibraryExW
GetModuleHandleA
GetModuleFileNameA
GetProcAddress

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemDirectoryA

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA

api-ms-win-core-synch-l1-1-0

SleepEx
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileExA

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe

api-ms-win-crt-heap-l1-1-0

_set_new_mode
realloc
calloc
malloc
free

api-ms-win-crt-stdio-l1-1-0

__p__commode
_fileno
fputs
fwrite
__acrt_iob_func
fputc
fclose
ftell
ferror
_lseeki64
getc
fread
__stdio_common_vsscanf
_setmode
puts
fgets
_isatty
fopen
_open
__stdio_common_vsprintf
fseek
feof
_set_fmode
_close
_read
_write
_get_osfhandle
fflush

api-ms-win-crt-time-l1-1-0

_time64
strftime
_gmtime64
_localtime64

api-ms-win-crt-convert-l1-1-0

strtol
strtoul
wcstombs
atoi
strtod
strtoll

api-ms-win-crt-runtime-l1-1-0

abort
exit
_initterm
__p___argv
_beginthreadex
_c_exit
_set_app_type
_seh_filter_exe
_exit
_initterm_e
__p___argc
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
__sys_nerr
_configure_narrow_argv
__sys_errlist
terminate
_errno
_get_initial_narrow_environment
strerror
_register_thread_local_exe_atexit_callback

api-ms-win-crt-string-l1-1-0

strncpy
strtok
strcspn
isprint
strncmp
strpbrk
_strdup
isupper
wcsncmp
strspn
tolower
strcmp

api-ms-win-crt-filesystem-l1-1-0

_access
_mkdir
_unlink
_fstat64
_stat64

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-multibyte-l1-1-0

_mbsnbcmp
_mbsnbcpy
_mbspbrk
_mbschr
_mbscmp

api-ms-win-crt-locale-l1-1-0

setlocale
_configthreadlocale

kernel32

UnhandledExceptionFilter
RtlVirtualUnwind
GetCurrentProcess
TerminateProcess
RtlLookupFunctionEntry
IsProcessorFeaturePresent
IsDebuggerPresent
GetModuleHandleW
GetCurrentProcessId
RtlCaptureContext
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwindEx

api-ms-win-core-processthreads-l1-1-0

TlsFree
TlsAlloc
TlsSetValue
TlsGetValue

api-ms-win-crt-math-l1-1-0

_fdopen
__setusermatherr

api-ms-win-crt-conio-l1-1-0

_getch

Sections

.text
Size: 365KB - Virtual size: 364KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9e2d88810eaf277296e0e26b4cc3e67b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

advapi32

crypt32

api-ms-win-core-console-l2-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-2

api-ms-win-core-toolhelp-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-synch-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-locale-l1-1-0

kernel32

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-conio-l1-1-0

Sections

.text Size: 365KB - Virtual size: 364KB

.rdata Size: 128KB - Virtual size: 127KB

.data Size: 512B - Virtual size: 3KB

.pdata Size: 10KB - Virtual size: 10KB

_RDATA Size: 512B - Virtual size: 252B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 365KB - Virtual size: 364KB

.rdata
Size: 128KB - Virtual size: 127KB

.data
Size: 512B - Virtual size: 3KB

.pdata
Size: 10KB - Virtual size: 10KB

_RDATA
Size: 512B - Virtual size: 252B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 3KB