horizon-v1[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
horizon-v1.exe
Size 751KB
Sample240611-tkq6bssfqc
SHA256 84a52564dbe52b832d037a08e5522f3a130aed7f8b9ff9bbcb57fffe1a7bce03
MD5 1c50e270964c65bed86fb7e830a9d88f
SHA1 ebe59b1e7fd8e10b16072ec33f3a9d0997cf221e
SHA512 cfe790548c5fc5d20884f1f677634eeddbb81542aa7b52b333b02fc6d7e6666139696545c7f0f7718929110f011ad69941ac66fc5fae5f54a0325dbead183071
SSDEEP 12288:TkxwFLr2O3KXp9ApCqoMxpjfLceGFHtGKGWY:T3Ff2GI9ApCqoMxprLceGDGKG
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
horizon-v1.exe

File Explorer

horizon-v1.exe

.exe 751KB

horizon-v1.exe

IMPHASH 662b0495e32d07b93175fbbfcad16c0d
SHA256 84a52564dbe52b832d037a08e5522f3a130aed7f8b9ff9bbcb57fffe1a7bce03
MD5 1c50e270964c65bed86fb7e830a9d88f
SHA1 ebe59b1e7fd8e10b16072ec33f3a9d0997cf221e
SHA512 cfe790548c5fc5d20884f1f677634eeddbb81542aa7b52b333b02fc6d7e6666139696545c7f0f7718929110f011ad69941ac66fc5fae5f54a0325dbead183071
SSDEEP 12288:TkxwFLr2O3KXp9ApCqoMxpjfLceGFHtGKGWY:T3Ff2GI9ApCqoMxprLceGDGKG
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

578020

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Work\Other-Sourcers\Monkey\Hey\output\build\horizon-v1.pdb

kernel32

CloseHandle DeleteCriticalSection lstrcmpiA MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency VerSetConditionMask FreeLibrary QueryPerformanceCounter CreateFileA OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter SleepConditionVariableSRW GetLastError AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileInformationByHandleEx GetModuleHandleW AreFileApisANSI GetTempPathW SetFileInformationByHandle GetFullPathNameW GetFileAttributesExW GetFileAttributesW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx FormatMessageA LocalFree Sleep CreateToolhelp32Snapshot CreateFileW InitializeCriticalSectionEx GetCurrentProcess Process32First GetCurrentProcessId GetProcAddress GetModuleHandleA LoadLibraryExA VirtualAlloc DeviceIoControl VirtualFree GetConsoleWindow SetConsoleWindowInfo SetCurrentConsoleFontEx GetStdHandle SetConsoleScreenBufferSize SetConsoleTitleA Process32Next SetConsoleTextAttribute WakeAllConditionVariable GetModuleFileNameA

user32

GetWindowRect DestroyWindow GetSystemMetrics ShowWindow SetWindowLongA SetWindowDisplayAffinity GetMonitorInfoA MoveWindow IsWindowUnicode CreateWindowExA SetLayeredWindowAttributes TranslateMessage LoadIconA PeekMessageA PostQuitMessage RegisterClassExA ReleaseCapture SetCursorPos DefWindowProcA SetProcessDPIAware UpdateWindow DispatchMessageA GetKeyState SetWindowPos SendInput GetCursorPos FindWindowA GetForegroundWindow GetAsyncKeyState ScreenToClient UnregisterClassA SetClipboardData GetClipboardData GetMessageExtraInfo LoadCursorA OpenClipboard MonitorFromWindow GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout CloseClipboard SetCapture EmptyClipboard SetCursor GetClientRect

gdi32

CreateSolidBrush

advapi32

RegQueryValueExA FreeSid AllocateAndInitializeSid GetUserNameW RegCreateKeyA LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyA RegDeleteKeyA RegSetValueExA OpenProcessToken RegCloseKey RegOpenKeyExA CheckTokenMembership

shell32

SHGetFolderPathW ShellExecuteA

msvcp140

?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?good@ios_base@std@@QEBA_NXZ ?_Xbad_function_call@std@@YAXXZ ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_id _Thrd_join _Query_perf_frequency _Query_perf_counter ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Random_device@std@@YAIXZ _Thrd_detach ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ _Cnd_signal _Cnd_init_in_situ _Mtx_destroy_in_situ _Mtx_lock _Mtx_init_in_situ _Cnd_wait _Xtime_get_ticks _Mtx_unlock _Cnd_destroy_in_situ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z _Strxfrm ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$collate@D@std@@2V0locale@2@A _Strcoll ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?tolower@?$ctype@D@std@@QEBADD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z ?uncaught_exceptions@std@@YAHXZ ?_Winerror_map@std@@YAHH@Z

ntdll

NtQuerySystemInformation RtlAnsiStringToUnicodeString RtlInitAnsiString RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

dbghelp

ImageNtHeader ImageDirectoryEntryToData ImageRvaToVa

d3d11

D3D11CreateDeviceAndSwapChain

imm32

ImmSetCandidateWindow ImmGetContext ImmReleaseContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

pdh

PdhOpenQueryA PdhAddCounterA PdhGetFormattedCounterValue PdhCollectQueryData PdhCloseQuery

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memchr __std_exception_destroy memmove __std_exception_copy __std_terminate __C_specific_handler memcpy memset memcmp __current_exception_context __current_exception _CxxThrowException strstr strchr

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode realloc free _callnewh

api-ms-win-crt-string-l1-1-0

strncpy strncmp tolower strcmp _stricmp wcscpy_s

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _cexit _seh_filter_exe _set_app_type _initialize_onexit_table _get_initial_narrow_environment _initterm _initterm_e _exit _initialize_narrow_environment __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback terminate exit _register_onexit_function _configure_narrow_argv abort _beginthreadex system _invalid_parameter_noinfo_noreturn _errno

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf __p__commode _set_fmode fputc fflush fclose fgetc fwrite fgetpos setvbuf __stdio_common_vsscanf _wfopen ungetc fseek ftell __stdio_common_vsprintf fread __acrt_iob_func _get_stream_buffer_pointers _fseeki64 fsetpos

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-convert-l1-1-0

atof strtoull strtoll strtod

api-ms-win-crt-math-l1-1-0

cosf sqrtf fmodf powf sinf sin atan2f _dsign _dclass ceilf __setusermatherr acosf

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale ___lc_codepage_func