Helio[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Helio.exe
Size

7.4MB
MD5

029e1e51857cf3f6e8be8b7d12f2e931
SHA1

e60b473502d81f638d1ec995bd5de8f86e10abb0
SHA256

46a72e2ae3b10f0603e0eaa0c7a23ed82cbf71ccae86d183b36b8857d534ec41
SHA512

93e7a4204bb482a9c63dac6a6d8499617fd448eaaa8793396f5b28b0dbbec01ca73b24fb4e6b77596f3a9cc8989fb0c9a8ad4c94e3532b95fc9777be2b80ce21
SSDEEP

98304:5DyxP05+mFD+60vUlXfMRR1/HH+MB02l4XiFPC:xyxP05+mFD+6eUNMRRxH+MB02l4XuPC

Score

1^/10

Malware Config

Signatures

Files

Helio.exe
.exe windows:6 windows x64 arch:x64

f1333a4f92ac75429957d65385236c81

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

74:5a:c0:d0:94:e1:24:4a:94:65:53:46:18:af:14:3a
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

06/10/2021, 00:00

Not After

05/10/2024, 23:59

Subject

CN=Peter Rudenko,O=Peter Rudenko,ST=Udmurtskaja Respublika,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

PeekNamedPipe
GetTempPathW
CreateMutexW
GetLocaleInfoW
CreateFileW
GetFileAttributesW
ReleaseMutex
GetSystemDirectoryW
GetComputerNameExW
UnmapViewOfFile
GetModuleHandleA
GetLogicalDriveStringsW
GetFileInformationByHandle
FormatMessageW
GetLastError
GetFileAttributesExW
OutputDebugStringW
TerminateThread
QueryPerformanceFrequency
DeleteFileW
GetNativeSystemInfo
LoadLibraryW
GetCurrentDirectoryW
SetCurrentDirectoryW
LocalFree
ReplaceFileW
ExitProcess
CreateProcessW
GetModuleHandleW
CopyFileW
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
MoveFileW
GetDriveTypeW
SetUnhandledExceptionFilter
FlushFileBuffers
GetCommandLineW
AttachConsole
CompareStringOrdinal
GlobalSize
GlobalAlloc
GlobalFree
GlobalLock
GetCurrentProcessId
GlobalUnlock
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
FindFirstFileExW
GetOEMCP
GetACP
IsValidCodePage
HeapSize
GetFileSizeEx
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
SetFilePointerEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
LCMapStringW
CompareStringW
GetTimeFormatW
HeapFree
HeapReAlloc
HeapAlloc
GetFullPathNameW
GetStdHandle
GetTimeZoneInformation
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileType
SetStdHandle
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
GetCPInfo
GetStringTypeW
LCMapStringEx
DecodePointer
EncodePointer
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetExitCodeThread
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
InitializeCriticalSectionEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
InitializeSListHead
GetSystemTimeAsFileTime
GetStartupInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
WriteConsoleW
SetEndOfFile
SetFilePointer
CreatePipe
GetModuleFileNameW
RemoveDirectoryW
TerminateProcess
GetModuleHandleExW
WriteFile
FindNextFileW
SetHandleInformation
FindFirstFileW
GetVolumeInformationW
ReadFile
GetSystemFirmwareTable
SetThreadAffinityMask
CreateDirectoryW
FreeLibrary
FindClose
GetFullPathNameA
ExpandEnvironmentStringsA
FindNextFileA
FindFirstFileA
IsDebuggerPresent
WideCharToMultiByte
DeleteCriticalSection
FindResourceW
LoadResource
LockResource
GetCurrentThreadId
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
TryEnterCriticalSection
SizeofResource
GetProcAddress
GetPriorityClass
ResetEvent
CloseHandle
GetThreadPriority
LoadLibraryA
GetCurrentThread
SetEvent
Sleep
MultiByteToWideChar
CreateEventW
WaitForSingleObject
SetThreadPriority
GetCurrentProcess
GetDateFormatW
SetPriorityClass

user32

GetWindowLongPtrW
UnregisterClassW
CreateWindowExW
SetWindowLongPtrW
DestroyWindow
DefWindowProcW
SetWindowsHookExW
UnhookWindowsHookEx
IsWindow
GetDesktopWindow
SendMessageW
SetWindowPos
GetWindowRect
GetWindow
CallWindowProcW
AttachThreadInput
GetWindowThreadProcessId
GetWindowTextW
TranslateMessage
SetFocus
RegisterClassExW
CallNextHookEx
EnumWindows
PeekMessageW
DispatchMessageW
GetFocus
SendMessageTimeoutW
PostMessageW
GetMessageW
ReleaseDC
GetDC
EndPaint
BeginPaint
GetCursorPos
SetCursorPos
GetAncestor
InvalidateRect
ReleaseCapture
GetParent
SystemParametersInfoW
EnableMenuItem
ShowCaret
DrawIconEx
UpdateLayeredWindow
GetClientRect
SetWindowLongW
SetCursor
ToUnicode
SetClipboardData
SetCapture
DestroyCaret
LoadCursorW
LoadIconW
GetClipboardData
BringWindowToTop
SetLayeredWindowAttributes
GetMessageTime
GetForegroundWindow
TrackMouseEvent
MapWindowPoints
CreateCaret
IsChild
EmptyClipboard
CloseClipboard
CreateIconIndirect
GetMonitorInfoW
GetWindowInfo
DestroyIcon
RedrawWindow
GetCapture
OpenClipboard
GetAsyncKeyState
ShowWindow
GetActiveWindow
SetCaretPos
GetKeyboardState
DestroyCursor
GetWindowPlacement
WindowFromPoint
MessageBeep
SetWindowTextW
EndDialog
GetIconInfo
GetWindowLongW
EnumDisplayMonitors
EnumChildWindows
MonitorFromWindow
MessageBoxW
IsWindowVisible
SetParent
GetSystemMenu
GetMessageExtraInfo
GetUpdateRgn
GetMessagePos
MapVirtualKeyW

gdi32

SetMapMode
RemoveFontMemResourceEx
CreateFontIndirectW
DeleteObject
GetGlyphOutlineW
ChoosePixelFormat
SwapBuffers
SetPixelFormat
GetOutlineTextMetricsW
SaveDC
CreateDIBSection
StretchDIBits
CreateRectRgnIndirect
CreateRectRgn
GetRegionData
GetObjectW
ExcludeClipRect
RestoreDC
CreateBitmap
CombineRgn
SelectObject
GetKerningPairsW
CreateCompatibleDC
EnumFontFamiliesExW
GetDeviceCaps
GetTextMetricsW
DeleteDC
SetMapperFlags
GetGlyphIndicesW

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

OpenProcessToken
RegCloseKey
RegQueryValueExW
RegOpenKeyW
RegOpenKeyExW
GetUserNameW
AccessCheck
GetNamedSecurityInfoW
MapGenericMask
DuplicateToken
RegEnumKeyW

shell32

ExtractAssociatedIconW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetKnownFolderPath
ShellExecuteW
SHGetSpecialFolderPathW
DragQueryFileW
SHCreateShellItem
SHParseDisplayName
SHGetMalloc

ole32

RevokeDragDrop
CoInitializeEx
RegisterDragDrop
DoDragDrop
CoUninitialize
CoTaskMemAlloc
OleUninitialize
CoCreateGuid
CLSIDFromString
CoTaskMemFree
CoCreateInstance
PropVariantClear
CoInitialize
OleInitialize

oleaut32

SysAllocString
SafeArrayPutElement
SafeArrayUnaccessData
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayDestroy

wininet

InternetReadFile
InternetSetOptionW
InternetConnectW
InternetCloseHandle
HttpSendRequestExW
HttpEndRequestW
InternetCrackUrlW
InternetSetFilePointer
HttpQueryInfoW
InternetOpenW
FtpOpenFileW
InternetWriteFile
HttpOpenRequestW

shlwapi

PathStripToRootW

winmm

midiInStart
midiInClose
midiOutUnprepareHeader
midiInAddBuffer
midiOutMessage
midiInGetNumDevs
midiOutShortMsg
midiOutGetNumDevs
midiOutLongMsg
midiOutClose
midiInStop
timeGetTime
timeGetDevCaps
timeKillEvent
timeSetEvent
timeBeginPeriod
midiInPrepareHeader
midiInMessage
midiOutOpen
midiInReset
midiInUnprepareHeader
midiInGetDevCapsW
midiOutGetDevCapsW
midiOutPrepareHeader
midiInOpen

imm32

ImmGetCompositionStringW
ImmAssociateContext
ImmSetCandidateWindow
ImmNotifyIME
ImmReleaseContext
ImmGetContext
ImmAssociateContextEx

dxgi

CreateDXGIFactory

opengl32

glLightf
glGetError
glGetPixelMapfv
glVertex3iv
glDrawBuffer
glRasterPos3iv
glEvalCoord1fv
glLightiv
glOrtho
glPixelMapusv
glTexCoord3i
glLightModeli
glGetString
glTexCoord4s
glTexSubImage2D
glLighti
glEvalCoord1dv
glPushAttrib
glGetIntegerv
glPolygonStipple
glClearStencil
glLogicOp
glColor4iv
glGetMaterialiv
glTexCoord4d
glTexCoord2i
glDepthFunc
glPixelStorei
glColor4usv
glGetLightiv
glShadeModel
glTexCoord1fv
glPrioritizeTextures
glCopyTexImage2D
glNormalPointer
glTexCoord1d
glGetFloatv
glRasterPos4dv
glIndexsv
glDeleteLists
wglMakeCurrent
glTexEnviv
glMaterialfv
glFogiv
glTexCoord1iv
glAreTexturesResident
glPushMatrix
glIsTexture
glPopName
glLightfv
glDisable
glEvalMesh2
glMultMatrixf
glGetTexGendv
glRasterPos4i
glColor4f
glClearDepth
glIndexs
glScalef
glRectf
glDrawElements
glGetTexParameteriv
glGetTexImage
glVertex2d
glTexCoord1s
glCopyTexImage1D
glGetClipPlane
glScaled
glColor3d
glListBase
glTexEnvi
glColorMaterial
glColor3ubv
glColorPointer
glColor4ub
glTexCoord1i
glColor3bv
glVertex3d
glFlush
glRasterPos3dv
glNormal3s
glBitmap
glFogi
glRasterPos3d
glClearIndex
glRasterPos2i
glIsEnabled
glRasterPos4d
glRotatef
glRasterPos2sv
glArrayElement
glPixelTransferf
glColor4b
glRasterPos2f
glColor3us
glGetPixelMapusv
glIndexMask
glTexCoord4i
glTexParameteriv
glFeedbackBuffer
glEvalMesh1
glPixelMapuiv
glVertex2f
glTexImage2D
glGetMaterialfv
glRectdv
glTranslatef
glPushName
glTexParameterf
glEvalCoord2d
glGetDoublev
glTexGeni
glTexCoord3d
glPointSize
glColor3fv
glNormal3fv
glGetTexParameterfv
glMaterialf
glClearAccum
glRects
glPopMatrix
glEvalCoord2fv
glColor4i
glLightModeliv
glViewport
glTexImage1D
glDepthRange
glEdgeFlagv
glEnableClientState
glVertex4dv
glRecti
glColor3dv
glEvalCoord1f
glNormal3sv
glVertex4sv
glIndexiv
glTexCoord3fv
glRasterPos3s
glInterleavedArrays
glClear
glEvalPoint2
glColor3uiv
glColor3ui
glIndexd
glVertex3i
glColor3s
glVertex2dv
glCopyPixels
glTexCoord3s
glPolygonOffset
glVertex2iv
wglShareLists
glTexSubImage1D
glLoadMatrixd
glIsList
glTexCoord2iv
glTexEnvf
glStencilMask
glTexCoord4fv
glRasterPos3fv
glGetTexLevelParameterfv
glMap1f
glNewList
glPopAttrib
glNormal3bv
glPolygonMode
glRotated
glTexGenf
wglGetCurrentContext
glColor3usv
glNormal3b
glPixelTransferi
glRasterPos3f
glRectfv
glBindTexture
glGetPointerv
glGenTextures
glNormal3dv
glColor4d
glRasterPos4iv
glVertexPointer
glGetMapiv
glEnable
glVertex3f
glIndexubv
glTexCoord3iv
glCullFace
glDepthMask
glPopClientAttrib
glRasterPos2d
glMapGrid1f
glGetLightfv
glLoadMatrixf
glTexGend
glTexCoord2d
glVertex3sv
glMapGrid2d
glEnd
glVertex4f
glPassThrough
glColor4s
glEdgeFlagPointer
glMaterialiv
glColor4ui
glVertex4d
glScissor
glFogf
glTexParameterfv
glTexCoord2dv
glSelectBuffer
glRasterPos3sv
glAccum
glGetMapfv
glTexCoord4dv
glTexCoord3sv
glCallList
glFogfv
glVertex2sv
glFrustum
glVertex3s
glCopyTexSubImage2D
glColor4bv
glRasterPos2dv
glTexCoord2f
glColor4uiv
glGetTexLevelParameteriv
glVertex4iv
glEvalPoint1
glDisableClientState
glGetTexGeniv
glColor4dv
glMateriali
glCopyTexSubImage1D
glRasterPos2iv
glGenLists
glMatrixMode
glTexCoord1f
glMapGrid1d
glTexCoord2fv
glEvalCoord2f
glTexGenfv
glTranslated
glVertex4fv
glRasterPos3i
glVertex3dv
glRasterPos4sv
glDrawPixels
glCallLists
glFrontFace
glIndexub
glTexGendv
glVertex2fv
glEvalCoord2dv
glTexCoord4iv
glLineWidth
glColor4sv
glColor3f
glNormal3f
glIndexfv
glRasterPos4s
glStencilFunc
glColor3i
glLineStipple
glTexCoord2sv
glBlendFunc
glReadPixels
wglCreateContext
glColorMask
glTexCoord4sv
glMap1d
glTexCoord3dv
glInitNames
glMapGrid2f
glRasterPos4f
glStencilOp
glIndexdv
glLoadIdentity
glColor3iv
glEdgeFlag
glRasterPos4fv
glRasterPos2s
glMultMatrixd
glEndList
glIndexPointer
wglGetProcAddress
glVertex3fv
glLoadName
glTexGeniv
glLightModelf
glRectiv
glPixelMapfv
glTexParameteri
glNormal3iv
glTexEnvfv
glVertex4s
glRenderMode
glFinish
glEvalCoord1d
glMap2f
glColor4ubv
glColor4fv
glDeleteTextures
glGetPolygonStipple
glGetTexEnvfv
glTexCoord2s
glTexCoord4f
glRectd
glVertex4i
glTexCoord3f
glPushClientAttrib
glHint
glReadBuffer
glTexCoord1sv
glAlphaFunc
glBegin
glRectsv
glTexCoordPointer
glColor3sv
glClipPlane
glIndexf
glIndexi
glPixelStoref
glPixelZoom
glNormal3d
glVertex2s
glGetTexEnviv
glClearColor
glLightModelfv
glVertex2i
glGetMapdv
glRasterPos2fv
glColor3ub
glGetBooleanv
glTexCoord1dv
glMap2d
glDrawArrays
glColor3b
wglDeleteContext
glNormal3i
glGetPixelMapuiv
glColor4us
glGetTexGenfv

Sections

.text
Size: 5.0MB - Virtual size: 5.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 156KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 222KB - Virtual size: 221KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f1333a4f92ac75429957d65385236c81

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

74:5a:c0:d0:94:e1:24:4a:94:65:53:46:18:af:14:3aCertificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

wininet

shlwapi

winmm

imm32

dxgi

opengl32

Sections

.text Size: 5.0MB - Virtual size: 5.0MB

.rdata Size: 1.9MB - Virtual size: 1.9MB

.data Size: 156KB - Virtual size: 263KB

.pdata Size: 222KB - Virtual size: 221KB

_RDATA Size: 512B - Virtual size: 252B

.rsrc Size: 62KB - Virtual size: 61KB

.reloc Size: 66KB - Virtual size: 66KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

74:5a:c0:d0:94:e1:24:4a:94:65:53:46:18:af:14:3a
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

.text
Size: 5.0MB - Virtual size: 5.0MB

.rdata
Size: 1.9MB - Virtual size: 1.9MB

.data
Size: 156KB - Virtual size: 263KB

.pdata
Size: 222KB - Virtual size: 221KB

_RDATA
Size: 512B - Virtual size: 252B

.rsrc
Size: 62KB - Virtual size: 61KB

.reloc
Size: 66KB - Virtual size: 66KB