Static task
static1
General
-
Target
Horion.dll
-
Size
2.4MB
-
MD5
45d7efb25d741224c7c4f84237f39a00
-
SHA1
7c10e3647783ad5d104ee0d34eb49f990feb9048
-
SHA256
abc4b2504c977f8291289d9376c5cf6069317c7f8860bbcb48a550982e195e60
-
SHA512
2284a9f4ca30650513289f0f925884ee1801d7e0e0b474583dabf8496ef509c8480cc294375da8d27190cb7397b89234a0dfb35368095b59bde7f0b36a090c9a
-
SSDEEP
49152:WnbP6Omia08m62pYTLOT+tu7gH1Icxzj30jvUJjviZkZsWfOql:ennizjlDuVS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Horion.dll
Files
-
Horion.dll.dll windows:6 windows x64 arch:x64
df036e2a68ae0e251da8ee8943ed0d4d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
RaiseException
QueryPerformanceFrequency
QueryPerformanceCounter
FindResourceA
LoadResource
LockResource
SizeofResource
Sleep
FreeLibraryAndExitThread
CreateThread
ExitThread
DisableThreadLibraryCalls
VirtualProtect
GetModuleHandleA
GetCurrentThreadId
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
MultiByteToWideChar
GlobalLock
GlobalUnlock
GlobalAlloc
GlobalFree
K32GetModuleInformation
GetCurrentProcess
HeapCreate
HeapFree
HeapDestroy
OpenThread
ResumeThread
CloseHandle
HeapReAlloc
HeapAlloc
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
Thread32Next
GetLastError
SuspendThread
GetThreadContext
SetThreadContext
FlushInstructionCache
GetModuleHandleW
GetProcAddress
VirtualFree
GetSystemInfo
VirtualQuery
VirtualAlloc
InterlockedPushEntrySList
InterlockedFlushSList
RtlPcToFileHeader
SetLastError
InitializeCriticalSectionAndSpinCount
RtlUnwindEx
LoadLibraryW
FormatMessageW
RtlUnwind
WriteConsoleW
HeapSize
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
SetEndOfFile
SetStdHandle
GetFileSizeEx
GetConsoleOutputCP
WriteFile
FlushFileBuffers
DeleteFileW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
GetStdHandle
GetModuleFileNameW
ExitProcess
SetFilePointerEx
GetFileType
ReadConsoleW
GetConsoleMode
ReadFile
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
user32
OpenClipboard
GetClipboardData
CloseClipboard
SetClipboardData
EmptyClipboard
ole32
CoCreateGuid
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsCreateStringReference
api-ms-win-core-localization-l1-2-0
GetLocaleInfoEx
FormatMessageA
GetCPInfo
LCMapStringEx
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
TryAcquireSRWLockExclusive
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
GetStringTypeW
CompareStringEx
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-file-l1-1-0
GetFileAttributesExW
CreateDirectoryW
CreateFileW
FindNextFileW
FindClose
FindFirstFileExW
FindFirstFileW
api-ms-win-core-file-l1-2-2
AreFileApisANSI
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
api-ms-win-core-processthreads-l1-1-0
GetStartupInfoW
TerminateProcess
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-fibers-l1-1-0
FlsGetValue
FlsAlloc
FlsFree
FlsSetValue
api-ms-win-core-synch-l1-2-0
WakeAllConditionVariable
SleepConditionVariableSRW
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
oleaut32
SysStringLen
SetErrorInfo
GetErrorInfo
SysFreeString
SysAllocString
Sections
.text Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 422KB - Virtual size: 422KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 21KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 601KB - Virtual size: 600KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ