Static task
static1
Behavioral task
behavioral1
Sample
Horion_1.dll
Resource
win10-20231215-en
General
-
Target
Horion_1.dll
-
Size
3.1MB
-
MD5
8cb9291c81f87babfec0a6da7a632f75
-
SHA1
7e095b77722b98f2d45ef0969b674075b6186013
-
SHA256
eced5c380bfb11a9d6dbedaa11886a7be475d4eedd0f26e848c7aff807215c5f
-
SHA512
8e09efd89eeb2f3c95ee98f8197cdbe9a850f987af5f9170990ff4d094edfe56bbcf8508fc6e36082e5faed56d75b4c727030eb0f5430e5f77892e2fc472d1e4
-
SSDEEP
49152:qmqXC/nwFg6DMpxCYzvkGkAHoJdgxRiee0yDrUMviZkZsWfRxaeQj0YqlNrrhNob:Vr8gOdgs5rUMDu6Q0YSNrrhNoprpX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource Horion_1.dll
Files
-
Horion_1.dll.dll windows:6 windows x64 arch:x64
2d11f83d2e34d2b942504637c83941af
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
RaiseException
QueryPerformanceFrequency
QueryPerformanceCounter
FindResourceA
LoadResource
LockResource
SizeofResource
Sleep
FreeLibraryAndExitThread
GetCurrentProcessId
GetLastError
CreateThread
ExitThread
DisableThreadLibraryCalls
VirtualProtect
CloseHandle
GetCurrentProcess
OpenProcess
CreateToolhelp32Snapshot
Module32FirstW
Module32NextW
GetProcAddress
GetModuleHandleA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
MultiByteToWideChar
GlobalLock
GlobalAlloc
GlobalUnlock
GlobalFree
K32GetModuleInformation
HeapSize
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
SetStdHandle
OutputDebugStringW
FlushFileBuffers
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
FormatMessageA
LocalFree
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
GetFileInformationByHandleEx
WideCharToMultiByte
WaitForSingleObjectEx
GetCurrentThreadId
InitializeSRWLock
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetModuleHandleW
CompareStringEx
GetCPInfo
GetStringTypeW
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
OpenThread
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
Thread32First
Thread32Next
GetSystemInfo
VirtualAlloc
VirtualFree
VirtualQuery
RtlUnwindEx
InterlockedFlushSList
RtlPcToFileHeader
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
GetFileType
GetModuleFileNameW
GetModuleHandleExW
WriteConsoleW
ReadFile
GetConsoleMode
ReadConsoleW
ExitProcess
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
DeleteFileW
WriteFile
GetConsoleOutputCP
GetFileSizeEx
RtlUnwind
user32
GetClipboardData
CloseClipboard
EmptyClipboard
SetClipboardData
OpenClipboard
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsDeleteString
winmm
PlaySoundA
Sections
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 259KB - Virtual size: 259KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ