Dorion_4[.]2[.]0_win64_portable[.]zip

Resubmissions

01/05/2024, 08:55

240501-kvwdcsdf55 8

01/05/2024, 08:54

240501-kvafwsbe2w 6

Sharing

Copy URL Twitter E-mail

General

Target

Dorion_4.2.0_win64_portable.zip
Size

5.6MB
MD5

2725d7ad532ab0600730fef2df172279
SHA1

9d407f49742c78c16ebc1fd42c046eaf3b023710
SHA256

59d54733d8f3593c2f211d1f656c5f28c62ef6adfcc95ea909187c7219d4bcea
SHA512

19a5d5dccae52b88f808704802e6913252078c5e8af85f6985b4570f99f56a9a438926ba6252fcd702f2c0aac6eb1799639364030fe647679119bc6a74f6af20
SSDEEP

98304:BuMq8WwgiWWoB7xJ5zlx1cJPeCiltBY+AjRNaC3A1Sf62gA7ArwhsCcwyLr2OaPR:BE8DgidyxJZj1AEltByVr3hf6a0CcwaY

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Dorion_4.2.0_win64_portable/Dorion.exe
unpack001/Dorion_4.2.0_win64_portable/updater.exe

Files

Dorion_4.2.0_win64_portable.zip
.zip
Dorion_4.2.0_win64_portable/Dorion.exe
.exe windows:6 windows x64 arch:x64

42f5d68ac85090e65a2971383b458573

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetUserDefaultLocaleName
GetSystemInfo
GetNativeSystemInfo
GetExitCodeProcess
EncodePointer
MoveFileExW
GlobalLock
GlobalSize
MultiByteToWideChar
GlobalAlloc
GetCurrentThreadId
FindClose
RemoveDirectoryW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
GetModuleHandleA
RtlUnwindEx
lstrlenW
CopyFileExW
AddVectoredExceptionHandler
IsProcessorFeaturePresent
TlsAlloc
TlsGetValue
LoadLibraryExW
WaitForSingleObject
CloseHandle
ReadFile
Sleep
GetProcessHeap
HeapAlloc
ConnectNamedPipe
ReleaseSRWLockExclusive
K32GetPerformanceInfo
OutputDebugStringW
OutputDebugStringA
LCIDToLocaleName
GetUserDefaultUILanguage
LoadLibraryExA
FreeLibrary
GlobalMemoryStatusEx
SetThreadStackGuarantee
CreateFileW
CreateNamedPipeW
GetQueuedCompletionStatusEx
WaitNamedPipeW
GetProcAddress
CreateIoCompletionPort
SetFileCompletionNotificationModes
LoadLibraryA
TryAcquireSRWLockExclusive
CreatePipe
CompareStringOrdinal
GetCurrentProcessId
CreateWaitableTimerExW
SetFilePointerEx
SetUnhandledExceptionFilter
GlobalUnlock
WakeAllConditionVariable
SleepConditionVariableSRW
WakeConditionVariable
GetNamedPipeServerProcessId
LoadLibraryW
DeviceIoControl
GetVolumeInformationW
GetDriveTypeW
GlobalFree
GetDiskFreeSpaceExW
SwitchToThread
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
AcquireSRWLockExclusive
GetLogicalDrives
RaiseException
RtlPcToFileHeader
DisconnectNamedPipe
PostQueuedCompletionStatus
SetWaitableTimer
GetTickCount64
GetTimeZoneInformationForYear
WriteFile
GetLastError
FlushFileBuffers
TlsSetValue
GetProcessId
TerminateProcess
GetCurrentThread
GetStdHandle
GetConsoleMode
OpenProcess
WriteConsoleW
SetLastError
QueryPerformanceFrequency
FormatMessageW
GetCurrentDirectoryW
WaitForSingleObjectEx
GetCurrentProcess
CreateMutexA
ReleaseMutex
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
GetEnvironmentVariableW
SetEnvironmentVariableW
GetTempPathW
GetModuleFileNameW
GetCommandLineW
SetFileInformationByHandle
GetFileInformationByHandle
GetFileInformationByHandleEx
GetProcessIoCounters
GetFullPathNameW
GetFinalPathNameByHandleW
FindNextFileW
CreateDirectoryW
FindFirstFileW
GetSystemTimes
GetProcessTimes
TlsFree
LocalFree
SetHandleInformation
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
CreateThread
ReadFileEx
SleepEx
WriteFileEx
ExitProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
AcquireSRWLockShared
ReleaseSRWLockShared
DeleteFileW
HeapReAlloc
HeapFree
VirtualQueryEx
ReadProcessMemory

user32

CreateMenu
CreatePopupMenu
UnregisterHotKey
RegisterHotKey
IsProcessDPIAware
IsWindow
RedrawWindow
SetWindowLongPtrW
GetMessageW
RegisterRawInputDevices
GetDC
GetMessageA
DispatchMessageA
BeginPaint
GetRawInputData
InvalidateRect
DrawIconEx
ValidateRect
PostThreadMessageW
RegisterClassW
RegisterWindowMessageA
SystemParametersInfoA
GetUpdateRect
DrawTextW
EndPaint
CloseWindow
SendMessageA
MapVirtualKeyW
GetWindowThreadProcessId
AdjustWindowRectEx
TranslateMessage
PostQuitMessage
DispatchMessageW
CreateAcceleratorTableW
VkKeyScanW
GetAncestor
AppendMenuW
TranslateAcceleratorW
ShowWindow
SetCursorPos
GetWindowTextW
GetMenu
GetWindowTextLengthW
GetActiveWindow
IsIconic
DestroyWindow
GetClientRect
IsWindowVisible
CreateWindowExW
TrackPopupMenu
SetMenu
GetWindowLongPtrW
SetWindowTextW
SetMenuItemInfoW
GetForegroundWindow
PostMessageW
GetMonitorInfoW
EnumDisplayMonitors
ToUnicodeEx
MonitorFromPoint
GetKeyboardLayout
ShowCursor
MapVirtualKeyExW
GetKeyState
CheckMenuItem
ChangeDisplaySettingsExW
SetWindowPlacement
EnableMenuItem
OpenClipboard
CreateIconFromResourceEx
ClipCursor
GetKeyboardState
CloseClipboard
SetClipboardData
EmptyClipboard
GetClipboardData
IsClipboardFormatAvailable
EnumWindows
MsgWaitForMultipleObjectsEx
GetAsyncKeyState
DestroyAcceleratorTable
GetClipCursor
GetSystemMenu
AllowSetForegroundWindow
SetWindowLongW
DestroyIcon
GetCursorPos
CloseTouchInputHandle
ScreenToClient
GetTouchInputInfo
ReleaseCapture
TrackMouseEvent
SetCapture
MonitorFromRect
GetWindowRect
ClientToScreen
GetWindowLongW
EnumChildWindows
DefWindowProcW
CreateIcon
PeekMessageW
SetWindowDisplayAffinity
SendInput
SetForegroundWindow
SendMessageW
RegisterTouchWindow
GetSystemMetrics
RegisterClassExW
SetCursor
LoadCursorW
FlashWindowEx
InvalidateRgn
SetWindowPos
MonitorFromWindow
GetWindowPlacement

advapi32

GetTokenInformation
OpenProcessToken
IsValidSid
GetLengthSid
RegQueryValueExW
RegSetValueExW
RegOpenKeyExW
CopySid
LookupAccountSidW
SystemFunction036
RegDeleteValueW
EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister
RegGetValueW
RegCloseKey
RegCreateKeyExW

shell32

SHGetKnownFolderPath
Shell_NotifyIconGetRect
DragFinish
SHCreateItemFromParsingName
ShellExecuteW
CommandLineToArgvW
Shell_NotifyIconW
SHAppBarMessage
DragQueryFileW

ole32

CoTaskMemFree
CoIncrementMTAUsage
CoTaskMemAlloc
RegisterDragDrop
RevokeDragDrop
CoInitialize
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance
CoUninitialize
CoInitializeEx
OleInitialize
CreateStreamOnHGlobal

comctl32

RemoveWindowSubclass
TaskDialogIndirect
SetWindowSubclass
DefSubclassProc

gdi32

DeleteObject
SetBkColor
CreatePen
GetDeviceCaps
CreateRectRgn
CreateSolidBrush
MoveToEx
LineTo
SetTextColor
TextOutW
CreateFontW
SelectObject

dwmapi

DwmExtendFrameIntoClientArea
DwmIsCompositionEnabled
DwmSetWindowAttribute
DwmEnableBlurBehindWindow

ntdll

RtlNtStatusToDosError
NtCancelIoFileEx
NtCreateFile
NtReadFile
NtQuerySystemInformation
NtWriteFile
RtlGetVersion
NtDeviceIoControlFile
NtQueryInformationProcess

crypt32

CertGetCertificateChain
CertFreeCertificateChain
CertDuplicateCertificateChain
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertOpenStore
CertCloseStore
CertFreeCertificateContext
CertVerifyCertificateChainPolicy
CertDuplicateStore
CertDuplicateCertificateContext

winmm

PlaySoundW

ws2_32

freeaddrinfo
shutdown
getaddrinfo
WSASocketW
ioctlsocket
bind
WSACleanup
setsockopt
WSAIoctl
WSAGetLastError
accept
WSASend
send
recv
getpeername
getsockname
connect
closesocket
getsockopt
listen
WSAStartup

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

oleaut32

SysAllocString
SetErrorInfo
SysStringLen
VariantClear
GetErrorInfo
SysFreeString

bcrypt

BCryptGenRandom

secur32

LsaFreeReturnBuffer
LsaGetLogonSessionData
LsaEnumerateLogonSessions
FreeCredentialsHandle
InitializeSecurityContextW
DeleteSecurityContext
QueryContextAttributesW
ApplyControlToken
EncryptMessage
AcquireCredentialsHandleA
DecryptMessage
AcceptSecurityContext
FreeContextBuffer

psapi

GetPerformanceInfo
GetProcessMemoryInfo
GetModuleFileNameExW

pdh

PdhAddEnglishCounterW
PdhRemoveCounter
PdhOpenQueryA
PdhCloseQuery
PdhGetFormattedCounterValue
PdhCollectQueryData

powrprof

CallNtPowerInformation

iphlpapi

GetIfTable2
GetAdaptersAddresses
FreeMibTable
GetIfEntry2

netapi32

NetApiBufferFree
NetUserGetLocalGroups
NetUserEnum
NetUserGetInfo

uxtheme

SetWindowTheme

api-ms-win-crt-math-l1-1-0

pow
ceil
floor
round
trunc
__setusermatherr

api-ms-win-crt-string-l1-1-0

wcsncmp
_wcsicmp
wcslen
strcpy_s

api-ms-win-crt-heap-l1-1-0

realloc
malloc
_set_new_mode
free
calloc
_callnewh

api-ms-win-crt-convert-l1-1-0

wcstol
_ultow_s

api-ms-win-crt-runtime-l1-1-0

_set_app_type
_seh_filter_exe
_get_initial_narrow_environment
_initterm
_initterm_e
_configure_narrow_argv
_initialize_onexit_table
exit
_exit
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
abort
_initialize_narrow_environment
_register_onexit_function
_crt_atexit
terminate

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 9.3MB - Virtual size: 9.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 399KB - Virtual size: 398KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Dorion_4.2.0_win64_portable/config.json
Dorion_4.2.0_win64_portable/icons/icon.ico
Dorion_4.2.0_win64_portable/icons/icon_macos.png
.png
Dorion_4.2.0_win64_portable/injection/shelter.js
.js
Dorion_4.2.0_win64_portable/updater.exe
.exe windows:6 windows x64 arch:x64

df80fbe169d5814c4cabc14e7bb32322

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

NtCreateFile
NtDeviceIoControlFile
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
NtWriteFile
NtCancelIoFileEx
RtlNtStatusToDosError

kernel32

SetHandleInformation
GetSystemInfo
SleepConditionVariableSRW
TryAcquireSRWLockExclusive
PostQueuedCompletionStatus
CreateIoCompletionPort
GetQueuedCompletionStatusEx
AcquireSRWLockShared
ReleaseSRWLockShared
SetFileCompletionNotificationModes
AcquireSRWLockExclusive
FreeEnvironmentStringsW
DeleteProcThreadAttributeList
CompareStringOrdinal
GetLastError
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
WaitForSingleObject
QueryPerformanceCounter
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetCurrentProcess
ReleaseSRWLockExclusive
CloseHandle
GetCommandLineW
IsProcessorFeaturePresent
SetFileInformationByHandle
DuplicateHandle
GetCurrentThreadId
GetStdHandle
GetCurrentProcessId
WriteFileEx
SleepEx
GetExitCodeProcess
WakeAllConditionVariable
WakeConditionVariable
QueryPerformanceFrequency
HeapFree
InitializeSListHead
HeapReAlloc
ReleaseMutex
GetModuleHandleA
GetProcAddress
GetProcessHeap
HeapAlloc
FindClose
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
CreateDirectoryW
FindFirstFileW
GetFinalPathNameByHandleW
GetConsoleMode
IsDebuggerPresent
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
ExitProcess
GetFullPathNameW
UnhandledExceptionFilter
CreateNamedPipeW
ReadFileEx
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
SetUnhandledExceptionFilter
MultiByteToWideChar
WriteConsoleW
CreateThread
GetCurrentThread
GetSystemTimeAsFileTime
GetTempPathW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA

secur32

DeleteSecurityContext
InitializeSecurityContextW
ApplyControlToken
EncryptMessage
AcceptSecurityContext
QueryContextAttributesW
FreeContextBuffer
DecryptMessage
AcquireCredentialsHandleA
FreeCredentialsHandle

ws2_32

ioctlsocket
bind
WSASocketW
getsockname
getsockopt
getpeername
shutdown
recv
WSAStartup
send
WSASend
closesocket
setsockopt
WSAIoctl
WSACleanup
freeaddrinfo
getaddrinfo
WSAGetLastError
connect

crypt32

CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertDuplicateStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertFreeCertificateChain
CertDuplicateCertificateChain
CertAddCertificateContextToStore

advapi32

SystemFunction036
RegCloseKey
RegOpenKeyExW
RegQueryValueExW

bcrypt

BCryptGenRandom

vcruntime140

__current_exception
_CxxThrowException
__current_exception_context
memset
__CxxFrameHandler3
memcpy
memmove
memcmp
__C_specific_handler

api-ms-win-crt-math-l1-1-0

pow
__setusermatherr

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___argv
_cexit
exit
_register_thread_local_exe_atexit_callback
_initterm
_initterm_e
_get_initial_narrow_environment
_exit
_initialize_narrow_environment
_configure_narrow_argv
terminate
_c_exit
_seh_filter_exe
_set_app_type
_initialize_onexit_table
_register_onexit_function
_crt_atexit

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 642KB - Virtual size: 642KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

42f5d68ac85090e65a2971383b458573

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

comctl32

gdi32

dwmapi

ntdll

crypt32

winmm

ws2_32

api-ms-win-core-winrt-l1-1-0

oleaut32

bcrypt

secur32

psapi

pdh

powrprof

iphlpapi

netapi32

uxtheme

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 9.3MB - Virtual size: 9.3MB

.rdata Size: 4.2MB - Virtual size: 4.2MB

.data Size: 3KB - Virtual size: 15KB

.pdata Size: 399KB - Virtual size: 398KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 29KB - Virtual size: 28KB

.reloc Size: 47KB - Virtual size: 46KB

df80fbe169d5814c4cabc14e7bb32322

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

secur32

ws2_32

crypt32

advapi32

bcrypt

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 642KB - Virtual size: 642KB

.data Size: 2KB - Virtual size: 2KB

.pdata Size: 75KB - Virtual size: 75KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 9.3MB - Virtual size: 9.3MB

.rdata
Size: 4.2MB - Virtual size: 4.2MB

.data
Size: 3KB - Virtual size: 15KB

.pdata
Size: 399KB - Virtual size: 398KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 29KB - Virtual size: 28KB

.reloc
Size: 47KB - Virtual size: 46KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 642KB - Virtual size: 642KB

.data
Size: 2KB - Virtual size: 2KB

.pdata
Size: 75KB - Virtual size: 75KB

.reloc
Size: 8KB - Virtual size: 7KB