Static task
static1
Behavioral task
behavioral1
Sample
catacombs.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
catacombs.exe
Resource
win10v2004-20240412-en
General
-
Target
catacombs.exe
-
Size
1.6MB
-
MD5
1894ce9a4169bea9080186ff7d7bef96
-
SHA1
549daf53bb2542f8df417ad271123ee8356397e9
-
SHA256
0c447c3707175b8558f0dc1552a575dd68c4ca53312f7ba127cc945b3292db09
-
SHA512
cea4592397b31de52208e73a3ce48254f8024d2b2a6c91a436a3164920f6897327fe369cb3985afe0823476e14e83114ee39ef30b7363fe52baca811d8151c22
-
SSDEEP
24576:q/xrbk1k9ohb+mYR558p4YE7StfBBxhzFRUMwur5Z8n2PSHroO7AGhSOguz:Ok1kxruNfhRaMw8X8n2VOx0Oz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource catacombs.exe
Files
-
catacombs.exe.exe windows:6 windows x86 arch:x86
5bf477cc6d95c88f49e17c9afc395cfb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
sdl2
SDL_Quit
SDL_Init
SDL_GetTicks
SDL_SetHint
SDL_GetPrefPath
SDL_GetBasePath
SDL_PollEvent
SDL_GameControllerGetJoystick
SDL_GameControllerOpen
SDL_JoystickInstanceID
SDL_GetRelativeMouseMode
SDL_SetRelativeMouseMode
SDL_GetMouseState
SDL_GL_SwapWindow
SDL_GL_SetSwapInterval
SDL_GL_GetDrawableSize
SDL_GL_MakeCurrent
SDL_GL_CreateContext
SDL_GL_SetAttribute
SDL_GL_GetProcAddress
SDL_DestroyWindow
SDL_SetWindowFullscreen
SDL_GetWindowSize
SDL_SetWindowSize
SDL_GetWindowFlags
SDL_GetWindowID
SDL_CreateWindow
SDL_SetWindowDisplayMode
SDL_GetWindowDisplayIndex
SDL_GetClosestDisplayMode
SDL_CloseAudioDevice
SDL_UnlockAudioDevice
SDL_LockAudioDevice
SDL_PauseAudioDevice
SDL_OpenAudioDevice
SDL_RWFromFile
SDL_GetError
SDL_SetMainReady
SDL_iconv_string
SDL_wcslen
SDL_isspace
SDL_free
SDL_malloc
kernel32
DeleteCriticalSection
HeapSize
WriteConsoleW
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExA
MoveFileExW
GetTimeZoneInformation
CreatePipe
GetFileAttributesExW
GetExitCodeProcess
WaitForSingleObject
ReadConsoleW
SetStdHandle
GetFullPathNameW
GetCurrentDirectoryW
DeleteFileW
SetFilePointerEx
RemoveDirectoryW
CreateDirectoryW
FlushFileBuffers
GetStringTypeW
DecodePointer
GetConsoleMode
GetConsoleCP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
GetCommandLineW
FindClose
FindFirstFileA
FindNextFileA
GetFileAttributesA
GetLastError
FreeLibrary
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleExA
GetProcAddress
LoadLibraryA
FormatMessageA
SetLastError
VirtualAlloc
VirtualFree
VirtualQuery
VirtualProtect
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RaiseException
RtlUnwind
EncodePointer
EnterCriticalSection
LeaveCriticalSection
SetEndOfFile
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
CloseHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
DuplicateHandle
CreateProcessA
GetTempPathW
QueryPerformanceFrequency
MultiByteToWideChar
WideCharToMultiByte
SetFileTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
GetStdHandle
WriteFile
GetACP
HeapFree
HeapAlloc
HeapReAlloc
GetDateFormatW
GetTimeFormatW
CompareStringW
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 343KB - Virtual size: 343KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 162KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 328B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 59KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ