Dorion_4[.]3[.]0_win64_portable[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

Dorion_4.3.0_win64_portable.zip
Size

5.5MB
MD5

4c9b87ba8961c569e93f986702ffc9f8
SHA1

f0ad6f4ff4fad8824f829e8c2bcfad4b395aec0c
SHA256

7bc813c53f1ff615f87141c4babbd6172c94b9cafc313e92870bf639c39e7dfc
SHA512

538155c477fd8777fd45cca625286104ce4f98f16a120546bbc331e34a195a4bd041918fb27959609db846761e15e650bc38bacdf175c5da17897b8f157fc4db
SSDEEP

98304:xCySrlHg27eE/lMvd3JhmKnEGXqvcuY7pQ9wQUCEg3zcqUdd/nXFN2pEH+T4:x7Slgq/+vd3JhmK7avDY7HQ7Eg3zcBP1

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Dorion.exe
unpack001/updater.exe

Files

Dorion_4.3.0_win64_portable.zip
.zip
Dorion.exe
.exe windows:6 windows x64 arch:x64

7f731f5ef201afb893a81f6aa6e5df60

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-core-synch-l1-2-0

WaitOnAddress
WakeByAddressSingle
WakeByAddressAll

bcryptprimitives

ProcessPrng

kernel32

CopyFileExW
MoveFileExW
RemoveDirectoryW
CreatePipe
CompareStringOrdinal
GetProcAddress
LoadLibraryA
RaiseException
RtlPcToFileHeader
EncodePointer
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
FindClose
SwitchToThread
GetCurrentThreadId
GetModuleHandleA
GetUserDefaultLocaleName
GetSystemInfo
GetNativeSystemInfo
lstrlenW
GlobalMemoryStatusEx
GlobalLock
GlobalSize
MultiByteToWideChar
GlobalAlloc
K32GetPerformanceInfo
HeapAlloc
TlsAlloc
GetExitCodeProcess
GetProcessHeap
TlsGetValue
WaitForSingleObject
LoadLibraryExW
CloseHandle
SetWaitableTimer
GetNamedPipeClientProcessId
GetNamedPipeServerProcessId
CreateNamedPipeW
GetQueuedCompletionStatusEx
Sleep
CreateWaitableTimerExW
OutputDebugStringW
OutputDebugStringA
CreateIoCompletionPort
SetFileCompletionNotificationModes
LCIDToLocaleName
GetUserDefaultUILanguage
LoadLibraryExA
RtlUnwindEx
ConnectNamedPipe
ReadFile
FlushFileBuffers
FreeLibrary
DisconnectNamedPipe
IsProcessorFeaturePresent
GetModuleHandleW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
AddVectoredExceptionHandler
SetThreadStackGuarantee
CreateFileW
WaitNamedPipeW
SetFilePointerEx
GlobalFree
GetCurrentProcessId
PostQueuedCompletionStatus
LoadLibraryW
GetTimeZoneInformationForYear
GetSystemTimePreciseAsFileTime
GetLastError
TlsSetValue
WriteFile
SleepConditionVariableSRW
VirtualQueryEx
GetProcessId
TerminateProcess
GetCurrentThread
GetStdHandle
GetConsoleMode
HeapReAlloc
WriteConsoleW
SetLastError
QueryPerformanceFrequency
FormatMessageW
GetCurrentDirectoryW
WaitForSingleObjectEx
GetCurrentProcess
CreateMutexA
ReleaseMutex
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
GetEnvironmentVariableW
SetEnvironmentVariableW
GetTempPathW
GetModuleFileNameW
GetCommandLineW
SetFileInformationByHandle
GetFileInformationByHandle
GetFileInformationByHandleEx
HeapFree
GetFullPathNameW
GetFinalPathNameByHandleW
FindNextFileW
CreateDirectoryW
FindFirstFileW
OpenProcess
DeviceIoControl
GetVolumeInformationW
GetDriveTypeW
SetHandleInformation
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
CreateThread
ReadFileEx
SleepEx
WriteFileEx
ExitProcess
QueryPerformanceCounter
DeleteFileW
GetDiskFreeSpaceExW
LocalFree
GetLogicalDrives
GetProcessTimes
GetSystemTimes
GetProcessIoCounters
ReadProcessMemory
GetTickCount64
WakeAllConditionVariable
AcquireSRWLockExclusive
GlobalUnlock
ReleaseSRWLockExclusive
TlsFree

user32

RegisterHotKey
UnregisterHotKey
CreateIconFromResourceEx
CreatePopupMenu
RegisterRawInputDevices
GetMessageA
DispatchMessageA
SystemParametersInfoA
BeginPaint
DestroyWindow
InvalidateRect
DrawIconEx
CreateMenu
ShowCursor
ClipCursor
GetClipCursor
SetWindowLongW
GetSystemMenu
DrawTextW
EndPaint
CloseWindow
SendMessageA
PostMessageW
GetWindowThreadProcessId
AdjustWindowRectEx
SetMenuItemInfoW
VkKeyScanW
GetAsyncKeyState
MapVirtualKeyExW
PostThreadMessageW
IsProcessDPIAware
EnumChildWindows
GetDC
PostQuitMessage
CreateAcceleratorTableW
AppendMenuW
TranslateMessage
DispatchMessageW
PeekMessageW
MsgWaitForMultipleObjectsEx
GetKeyState
GetKeyboardState
DestroyAcceleratorTable
OpenClipboard
ToUnicodeEx
GetKeyboardLayout
EnumWindows
CloseClipboard
SetClipboardData
EmptyClipboard
GetClipboardData
AllowSetForegroundWindow
EnableMenuItem
IsClipboardFormatAvailable
DestroyIcon
GetWindowLongPtrW
CreateIcon
GetWindowTextW
SetWindowPlacement
CheckMenuItem
GetWindowTextLengthW
SendMessageW
ChangeDisplaySettingsExW
TranslateAcceleratorW
GetAncestor
GetUpdateRect
ValidateRect
GetRawInputData
DefWindowProcW
SetWindowLongPtrW
GetMonitorInfoW
SetWindowTextW
CloseTouchInputHandle
ScreenToClient
GetTouchInputInfo
TrackMouseEvent
SetCapture
MonitorFromRect
GetWindowPlacement
GetWindowLongW
EnumDisplayMonitors
RegisterClassW
RedrawWindow
ShowWindow
RegisterClassExW
RegisterWindowMessageA
TrackPopupMenu
RegisterTouchWindow
GetSystemMetrics
IsWindow
CreateWindowExW
GetMessageW
ReleaseCapture
GetCursorPos
SetCursorPos
SetCursor
LoadCursorW
SendInput
MapVirtualKeyW
SetForegroundWindow
GetForegroundWindow
InvalidateRgn
SetWindowPos
GetClientRect
FlashWindowEx
GetActiveWindow
GetWindowRect
ClientToScreen
GetMenu
IsIconic
IsWindowVisible
MonitorFromWindow
MonitorFromPoint
SetMenu
SetWindowDisplayAffinity

advapi32

CopySid
RegCreateKeyExW
RegDeleteValueW
RegGetValueW
EventUnregister
EventWriteTransfer
OpenProcessToken
GetTokenInformation
IsValidSid
GetLengthSid
RegQueryValueExW
RegSetValueExW
RegOpenKeyExW
SystemFunction036
LookupAccountSidW
RegCloseKey
EventSetInformation
EventRegister

shell32

CommandLineToArgvW
Shell_NotifyIconGetRect
DragFinish
DragQueryFileW
SHCreateItemFromParsingName
ShellExecuteW
SHAppBarMessage
Shell_NotifyIconW
SHGetKnownFolderPath

ole32

CoIncrementMTAUsage
CoTaskMemFree
CoInitialize
CoCreateInstance
CoUninitialize
CoInitializeSecurity
OleInitialize
CreateStreamOnHGlobal
RegisterDragDrop
RevokeDragDrop
CoSetProxyBlanket
CoInitializeEx
CoTaskMemAlloc

ntdll

NtCancelIoFileEx
NtDeviceIoControlFile
RtlGetVersion
NtQueryInformationProcess
NtQuerySystemInformation
RtlNtStatusToDosError
NtCreateFile
NtWriteFile
NtReadFile

dwmapi

DwmExtendFrameIntoClientArea
DwmEnableBlurBehindWindow
DwmSetWindowAttribute
DwmIsCompositionEnabled
DwmGetColorizationColor

bcrypt

BCryptGenRandom

crypt32

CertDuplicateCertificateContext
CertDuplicateCertificateChain
CertEnumCertificatesInStore
CertOpenStore
CertDuplicateStore
CertFreeCertificateContext
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertGetCertificateChain
CertCloseStore
CertAddCertificateContextToStore

gdi32

CreateFontW
GetDeviceCaps
CreateRectRgn
DeleteObject
SetTextColor
LineTo
MoveToEx
TextOutW
SelectObject
CreateSolidBrush
SetBkColor
CreatePen

comctl32

DefSubclassProc
SetWindowSubclass
TaskDialogIndirect
RemoveWindowSubclass

winmm

PlaySoundW

ws2_32

connect
WSASocketW
ioctlsocket
bind
closesocket
setsockopt
WSAIoctl
WSAGetLastError
accept
listen
shutdown
WSASend
send
getaddrinfo
freeaddrinfo
recv
WSAStartup
WSACleanup
getpeername
getsockname
getsockopt

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

oleaut32

SysStringLen
SysAllocString
SetErrorInfo
SysFreeString
VariantClear
GetErrorInfo

secur32

AcquireCredentialsHandleA
LsaFreeReturnBuffer
DecryptMessage
EncryptMessage
QueryContextAttributesW
FreeCredentialsHandle
LsaGetLogonSessionData
InitializeSecurityContextW
AcceptSecurityContext
LsaEnumerateLogonSessions
ApplyControlToken
FreeContextBuffer
DeleteSecurityContext

psapi

GetProcessMemoryInfo
GetModuleFileNameExW
GetPerformanceInfo

pdh

PdhAddEnglishCounterW
PdhGetFormattedCounterValue
PdhRemoveCounter
PdhCloseQuery
PdhCollectQueryData
PdhOpenQueryA

iphlpapi

GetAdaptersAddresses
FreeMibTable
GetIfTable2
GetIfEntry2

netapi32

NetUserGetInfo
NetUserGetLocalGroups
NetUserEnum
NetApiBufferFree

powrprof

CallNtPowerInformation

uxtheme

SetWindowTheme

api-ms-win-crt-math-l1-1-0

floor
pow
ceil
trunc
round
__setusermatherr

api-ms-win-crt-string-l1-1-0

strcpy_s
wcsncmp
wcslen
_wcsicmp

api-ms-win-crt-heap-l1-1-0

malloc
realloc
_set_new_mode
free
calloc
_callnewh

api-ms-win-crt-convert-l1-1-0

wcstol
_ultow_s

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
abort
exit
_exit
terminate
__p___argc
__p___argv
_crt_atexit
_c_exit
_register_thread_local_exe_atexit_callback
_set_app_type
_seh_filter_exe
_initialize_onexit_table
_cexit

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 9.0MB - Virtual size: 9.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 406KB - Virtual size: 405KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
icons/icon.ico
icons/icon_macos.png
.png
injection/shelter.js
.js
updater.exe
.exe windows:6 windows x64 arch:x64

d3bdd90d3d574844cddbe4aca9f1bf3b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress
WakeByAddressAll
WakeByAddressSingle

ntdll

RtlNtStatusToDosError
NtDeviceIoControlFile
NtCreateFile
NtCancelIoFileEx
RtlVirtualUnwind
RtlLookupFunctionEntry
NtWriteFile
RtlCaptureContext

kernel32

SetHandleInformation
GetSystemInfo
PostQueuedCompletionStatus
CreateIoCompletionPort
GetQueuedCompletionStatusEx
CloseHandle
GetCurrentThreadId
GetSystemTimeAsFileTime
SetFileCompletionNotificationModes
InitializeSListHead
IsDebuggerPresent
FreeEnvironmentStringsW
DeleteProcThreadAttributeList
CompareStringOrdinal
GetLastError
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
WaitForSingleObject
QueryPerformanceCounter
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
UnhandledExceptionFilter
GetCommandLineW
GetCurrentProcess
DuplicateHandle
SetUnhandledExceptionFilter
GetStdHandle
GetCurrentProcessId
WriteFileEx
SleepEx
GetExitCodeProcess
QueryPerformanceFrequency
HeapFree
HeapReAlloc
lstrlenW
ReleaseMutex
GetProcessHeap
HeapAlloc
FindClose
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
CreateDirectoryW
FindFirstFileW
GetFinalPathNameByHandleW
GetConsoleMode
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
ExitProcess
CreateNamedPipeW
ReadFileEx
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
MultiByteToWideChar
WriteConsoleW
CreateThread
GetCurrentThread
GetFullPathNameW
GetModuleHandleA
GetProcAddress
GetTempPathW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
SetFileInformationByHandle
IsProcessorFeaturePresent

ws2_32

ioctlsocket
connect
shutdown
WSASocketW
getpeername
getsockname
recv
send
setsockopt
WSAIoctl
closesocket
WSAGetLastError
WSAStartup
WSACleanup
WSASend
freeaddrinfo
getaddrinfo
getsockopt
bind

secur32

EncryptMessage
AcceptSecurityContext
InitializeSecurityContextW
FreeContextBuffer
DecryptMessage
ApplyControlToken
AcquireCredentialsHandleA
FreeCredentialsHandle
DeleteSecurityContext
QueryContextAttributesW

advapi32

RegOpenKeyExW
RegCloseKey
RegQueryValueExW

crypt32

CertDuplicateCertificateChain
CertFreeCertificateChain
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertOpenStore
CertCloseStore
CertDuplicateStore
CertFreeCertificateContext
CertDuplicateCertificateContext

vcruntime140

__C_specific_handler
__current_exception_context
__current_exception
__CxxFrameHandler3
_CxxThrowException
memcpy
memmove
memcmp
memset

api-ms-win-crt-math-l1-1-0

pow
__setusermatherr

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe
_set_app_type
_initialize_onexit_table
_crt_atexit
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_register_onexit_function
terminate
_configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 643KB - Virtual size: 642KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7f731f5ef201afb893a81f6aa6e5df60

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

user32

advapi32

shell32

ole32

ntdll

dwmapi

bcrypt

crypt32

gdi32

comctl32

winmm

ws2_32

api-ms-win-core-winrt-l1-1-0

oleaut32

secur32

psapi

pdh

iphlpapi

netapi32

powrprof

uxtheme

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 9.0MB - Virtual size: 9.0MB

.rdata Size: 4.1MB - Virtual size: 4.1MB

.data Size: 3KB - Virtual size: 15KB

.pdata Size: 406KB - Virtual size: 405KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 35KB - Virtual size: 34KB

.reloc Size: 47KB - Virtual size: 46KB

d3bdd90d3d574844cddbe4aca9f1bf3b

Headers

DLL Characteristics

File Characteristics

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ntdll

kernel32

ws2_32

secur32

advapi32

crypt32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 643KB - Virtual size: 642KB

.data Size: 2KB - Virtual size: 2KB

.pdata Size: 76KB - Virtual size: 75KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 9.0MB - Virtual size: 9.0MB

.rdata
Size: 4.1MB - Virtual size: 4.1MB

.data
Size: 3KB - Virtual size: 15KB

.pdata
Size: 406KB - Virtual size: 405KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 35KB - Virtual size: 34KB

.reloc
Size: 47KB - Virtual size: 46KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 643KB - Virtual size: 642KB

.data
Size: 2KB - Virtual size: 2KB

.pdata
Size: 76KB - Virtual size: 75KB

.reloc
Size: 8KB - Virtual size: 7KB