6602787a9b2675fd590bf9c1ca592d9187592fa48b810ce688cb766fcac2531d

Sharing

Copy URL Twitter E-mail

General

Target

6602787a9b2675fd590bf9c1ca592d9187592fa48b810ce688cb766fcac2531d
Size

3.5MB
MD5

6050aa78e832957647f9485a0599ab4d
SHA1

2541922764c9b9b811f7aca16e30faaf9c8a480c
SHA256

6602787a9b2675fd590bf9c1ca592d9187592fa48b810ce688cb766fcac2531d
SHA512

f3752ae50406926dcb993f06fa219c611c2ebb28eb05c38e5a85704ea7a6207ffe8434f4ec10a10f3fb94e95a4d75de56d01665677b20987615a41de2e32e175
SSDEEP

49152:sf3YfCJqdBS+a4OZbOBWJJMpRrNBYKC6YC343jeLkzVmrWt018tJ8LC:n0T+QPO3qlezK8W

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6602787a9b2675fd590bf9c1ca592d9187592fa48b810ce688cb766fcac2531d

Files

6602787a9b2675fd590bf9c1ca592d9187592fa48b810ce688cb766fcac2531d
.exe windows:6 windows x86 arch:x86

1dad712cbb9de38e56c6e17adf199e6b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Jenkins\.jenkins\workspace\halodesk\coral_desktop\bin\Release\HaloDesktop.pdb

Imports

kernel32

FindNextFileW
ExpandEnvironmentStringsW
DeviceIoControl
lstrcpynW
lstrlenA
lstrlenW
GetComputerNameW
GetFileSize
GetFileAttributesW
GetFileSizeEx
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
MoveFileExW
CompareStringW
SetFilePointer
FindFirstFileW
FindClose
GetCurrentThread
GetCurrentProcess
GetOverlappedResult
CreateNamedPipeW
SetNamedPipeHandleState
DisconnectNamedPipe
ConnectNamedPipe
WriteFile
ReadFile
CreateFileW
MulDiv
WinExec
LoadLibraryA
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
CreateFileMappingW
WriteProcessMemory
VirtualFreeEx
VirtualAllocEx
GetTickCount
OpenProcess
CreateRemoteThread
ReleaseMutex
IsBadReadPtr
lstrcmpW
SetProcessDEPPolicy
LoadLibraryExW
VirtualProtect
GetSystemDirectoryW
GetStartupInfoW
CreateProcessW
GetCurrentProcessId
CreateMutexW
InitializeCriticalSectionEx
SetUnhandledExceptionFilter
DecodePointer
GetCommandLineW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetModuleFileNameW
ResetEvent
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
DeleteFileW
SetStdHandle
CreateProcessA
GetExitCodeProcess
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetStdHandle
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
SetFilePointerEx
GetFileType
GetModuleHandleExW
ExitThread
VirtualQuery
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
ReleaseSemaphore
lstrcmpiW
GetCurrentThreadId
RaiseException
VerifyVersionInfoW
FormatMessageA
LocalFree
LoadLibraryW
GetProcAddress
GetModuleHandleA
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateThread
QueueUserAPC
CreateWaitableTimerW
WaitForMultipleObjects
Sleep
SetWaitableTimer
CreateEventW
SleepEx
WaitForSingleObject
SetEvent
InitializeCriticalSectionAndSpinCount
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateIoCompletionPort
SetLastError
GetLastError
CloseHandle
VerSetConditionMask
GetModuleHandleW
WideCharToMultiByte
MultiByteToWideChar
FindResourceW
SizeofResource
LockResource
LoadResource
FreeLibrary
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
SignalObjectAndWait
CreateTimerQueue
AreFileApisANSI
HeapCreate
GetFullPathNameW
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
GetFullPathNameA
UnlockFileEx
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
FlushViewOfFile
GetVersionExA
DeleteFileA
GetSystemInfo
HeapCompact
UnlockFile
CreateFileMappingA
LockFileEx
GetSystemWindowsDirectoryW
InterlockedCompareExchange
CreateFileA
lstrcmpiA
lstrcmpA
FlushFileBuffers
GetVersionExW
TerminateProcess
UnhandledExceptionFilter
GetTempFileNameW
GlobalFree
GlobalLock
GlobalUnlock
FindResourceExW
DeleteCriticalSection
GlobalAlloc
GetVersion
GetLocalTime
ResumeThread
SystemTimeToFileTime
GetSystemTime
SetEndOfFile
FreeResource
ExitProcess
GetACP
InterlockedDecrement
InterlockedIncrement
InterlockedExchangeAdd
GetTempPathW
GetCPInfo
LeaveCriticalSection
EnterCriticalSection
GetLocaleInfoW
LCMapStringW
GetSystemTimeAsFileTime
TryEnterCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
GetExitCodeThread
SwitchToThread
WaitForSingleObjectEx
DuplicateHandle
FormatMessageW
GetStringTypeW
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
OutputDebugStringW
IsDebuggerPresent
InitializeCriticalSection
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy

user32

SetActiveWindow
CreateWindowExW
SetWindowPos
SendMessageTimeoutW
PeekMessageW
DispatchMessageW
KillTimer
TranslateMessage
GetMessageW
SetFocus
MoveWindow
FindWindowW
IsWindowVisible
DestroyWindow
SystemParametersInfoW
DestroyIcon
LoadIconW
EqualRect
GetCursorPos
GetWindowRect
SetCursor
SendMessageW
CharNextW
FindWindowExW
EnumWindows
GetClassNameW
CallWindowProcW
ShowWindow
RegisterWindowMessageW
TrackMouseEvent
RegisterHotKey
SetWindowLongW
GetWindowLongW
GetDC
ScreenToClient
IsWindow
PostMessageW
GetClassInfoExW
RegisterClassExW
UnregisterClassW
PostQuitMessage
SetForegroundWindow
SetTimer
DefWindowProcW
ClientToScreen
GetWindowTextW
SetWindowTextW
RemovePropW
GetPropW
SetPropW
CharLowerW
GetDlgCtrlID
GetDlgItem
EndDialog
LoadStringW
UpdateWindow
EnumDisplayMonitors
GetMonitorInfoW
MapVirtualKeyW
GetKeyNameTextW
GetActiveWindow
GetParent
OffsetRect
FrameRect
FillRect
GetCaretPos
SetCaretPos
GetClientRect
InvalidateRect
EndPaint
BeginPaint
GetWindowDC
DrawTextW
GetFocus
SetRectEmpty
LockWorkStation
LoadCursorW
GetWindowThreadProcessId
PtInRect
CopyRect
wsprintfW
wvsprintfW
InflateRect
UnionRect
IsChild
UpdateLayeredWindow
IsZoomed
GetKeyState
SetCapture
ReleaseCapture
ReleaseDC
GetUpdateRect
CreateCaret
GetCaretBlinkTime
MapWindowPoints
IntersectRect
IsRectEmpty
GetWindow
MonitorFromWindow
RegisterClassW
EnableWindow
LoadImageW
CreateAcceleratorTableW
InvalidateRgn
IsIconic
SetWindowRgn
MonitorFromPoint
MessageBoxW
GetWindowTextLengthW
DrawIconEx
CharPrevW
SetRect
GetIconInfo
HideCaret
ShowCaret
GetSysColor
SetLayeredWindowAttributes
RedrawWindow
IsWindowEnabled
UnregisterHotKey

gdi32

CreatePen
Rectangle
RestoreDC
SaveDC
GetTextMetricsW
SetWindowOrgEx
GetDeviceCaps
CreateRoundRectRgn
CombineRgn
CreateRectRgnIndirect
GetCharABCWidthsW
GetClipBox
SelectClipRgn
CreateCompatibleBitmap
StretchBlt
SetStretchBltMode
SetDIBColorTable
TextOutW
GetDIBits
SetDIBitsToDevice
ExtTextOutW
CreateDCW
GetTextExtentPoint32W
CreateCompatibleDC
CreateDIBSection
GetObjectW
BitBlt
SetTextColor
CreateSolidBrush
DeleteDC
CreateFontIndirectW
DeleteObject
SetBkMode
SelectObject
ExtSelectClipRgn
SetBkColor
GetStockObject

comdlg32

GetOpenFileNameW
ChooseColorW

advapi32

RegOpenKeyExA
RegEnumKeyExA
RegGetValueW
RegCreateKeyW
RegNotifyChangeKeyValue
RegQueryValueExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetTokenInformation
OpenProcessToken
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
RegQueryValueExA

shell32

Shell_NotifyIconW
SHBindToParent
SHGetFolderLocation
ord155
SHFileOperationW
ShellExecuteExW
SHGetFolderPathW
SHGetSpecialFolderPathW
ord165
SHGetFileInfoW
ShellExecuteW

ole32

CoCreateInstance
CLSIDFromString
CLSIDFromProgID
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoInitialize
OleInitialize
CoCreateGuid
CoUninitialize
CreateStreamOnHGlobal
OleLockRunning

oleaut32

SafeArrayCreate
VariantInit
SafeArrayPutElement
VariantClear
VarBstrCmp
SysAllocString
SysFreeString
VariantTimeToSystemTime
SysAllocStringLen
VarUI4FromStr
SystemTimeToVariantTime
SysStringLen

shlwapi

StrCmpNIW
StrTrimA
PathRemoveFileSpecW
SHSetValueA
SHGetValueA
StrStrIA
SHAutoComplete
StrStrIW
StrCmpIW
PathAppendW
PathFileExistsW
PathIsDirectoryW
SHGetValueW
StrCpyW
wnsprintfW
StrRetToBufW
PathAddBackslashW
PathFindExtensionW
PathFindFileNameW
PathCombineW
PathStripPathW
PathRemoveExtensionW

comctl32

_TrackMouseEvent
ord17
InitCommonControlsEx
ImageList_DrawEx

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

gdiplus

GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromHBITMAP
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipLoadImageFromStreamICM
GdipDrawImagePointsI
GdiplusShutdown
GdiplusStartup
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFile
GdipGetImageHeight
GdipGetImageWidth
GdipSaveImageToFile
GdipDisposeImage
GdipCloneImage
GdipFree
GdipAlloc
GdipFillPath
GdipGraphicsClear
GdipCloneBitmapAreaI
GdipCreateBitmapFromStream
GdipCreateTexture
GdipClosePathFigure
GdipDrawImageRectRectI
GdipAddPathLineI
GdipDrawImageRectI
GdipSetInterpolationMode
GdipGetImagePixelFormat
GdipCreatePath
GdipDeletePath
GdipAddPathArcI
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipSetPenMode
GdipSetPenDashStyle
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipDrawLineI
GdipDrawRectangleI
GdipDrawPath
GdipFillEllipseI
GdipAddPathArc
GdipDrawEllipseI
GdipLoadImageFromFile
GdipGetImageGraphicsContext

imm32

ImmAssociateContext

ws2_32

WSAAddressToStringW
getaddrinfo
freeaddrinfo
WSAIoctl
WSASocketW
WSASend
WSARecv
select
WSAGetLastError
WSASetLastError
WSACleanup
WSAStartup
shutdown
setsockopt
ntohs
ntohl
listen
htons
htonl
getsockopt
getsockname
getpeername
ioctlsocket
connect
closesocket
__WSAFDIsSet
accept
bind

wininet

InternetSetCookieW
InternetCrackUrlW
InternetGetConnectedState
DeleteUrlCacheEntryW

sensapi

IsNetworkAlive

iphlpapi

GetAdaptersInfo

crypt32

CertGetNameStringW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

msimg32

GradientFill
AlphaBlend

urlmon

URLDownloadToCacheFileW
URLDownloadToFileW

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 439KB - Virtual size: 439KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 402KB - Virtual size: 401KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1dad712cbb9de38e56c6e17adf199e6b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

version

gdiplus

imm32

ws2_32

wininet

sensapi

iphlpapi

crypt32

wintrust

msimg32

urlmon

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.rdata Size: 439KB - Virtual size: 439KB

.data Size: 64KB - Virtual size: 88KB

.rsrc Size: 402KB - Virtual size: 401KB

.reloc Size: 130KB - Virtual size: 130KB

.text
Size: 2.5MB - Virtual size: 2.5MB

.rdata
Size: 439KB - Virtual size: 439KB

.data
Size: 64KB - Virtual size: 88KB

.rsrc
Size: 402KB - Virtual size: 401KB

.reloc
Size: 130KB - Virtual size: 130KB