Static task
static1
General
-
Target
HorionS.dll
-
Size
1.8MB
-
MD5
ecaaf501726cbdcc9af5e67fc2ddcb49
-
SHA1
7a89971673f6a2adfd3d3e18daa2553fe1f6cc01
-
SHA256
d5e5132cc6818d4f0edf33aede5496fd6ef95172399903c29e3f4225a97a324b
-
SHA512
25ee1e34474c6b51b1b82989bf554e0bf6cfefb4b68338e4e4aff3e0e9d434c07524d31a2778e30b30bd53d46f07be623bf292cf7fe38e5012ee312db8ea097c
-
SSDEEP
49152:bXKF3JYRrOLRftaLOXN6UjxSwOl+GNTGqUWj:A6tDNV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource HorionS.dll
Files
-
HorionS.dll.dll windows:6 windows x64 arch:x64
7316f8898eb5c696387db1dcf211be04
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
GetCurrentProcess
OpenProcess
CreateToolhelp32Snapshot
Module32FirstW
Module32NextW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
MultiByteToWideChar
K32GetModuleInformation
SetLastError
FormatMessageW
SleepEx
GetSystemDirectoryA
FreeLibrary
GetTickCount
WideCharToMultiByte
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
VerSetConditionMask
VerifyVersionInfoA
CreateFileA
GetFileSizeEx
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
VirtualQuery
GetProcAddress
VirtualProtect
IsBadReadPtr
GetModuleHandleW
GetModuleHandleA
FreeLibraryAndExitThread
DisableThreadLibraryCalls
ExitThread
SetStdHandle
GetTimeZoneInformation
DeleteFileW
FlushFileBuffers
EnumSystemLocalesW
CreateThread
GetCurrentProcessId
Sleep
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
DecodePointer
QueryPerformanceFrequency
QueryPerformanceCounter
LoadLibraryA
RaiseException
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetConsoleOutputCP
WriteFile
ReadConsoleW
GetConsoleMode
ExitProcess
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
WriteConsoleW
GetModuleFileNameW
GetModuleHandleExW
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InterlockedFlushSList
RtlUnwindEx
RtlPcToFileHeader
VirtualFree
VirtualAlloc
GetSystemInfo
Thread32Next
Thread32First
FlushInstructionCache
SetThreadContext
GetThreadContext
ResumeThread
SuspendThread
OpenThread
HeapCreate
OutputDebugStringW
InitializeSListHead
GetStartupInfoW
RtlUnwind
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
FormatMessageA
GetCurrentThreadId
GetExitCodeThread
LocalFree
GetCurrentDirectoryW
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
GetFileInformationByHandleEx
InitializeSRWLock
TryEnterCriticalSection
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
GetStringTypeW
EncodePointer
LCMapStringEx
GetSystemTimeAsFileTime
GetCPInfo
user32
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
advapi32
CryptAcquireContextA
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
CryptReleaseContext
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateStringReference
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
crypt32
CertFindCertificateInStore
PFXImportCertStore
CertCloseStore
CertOpenStore
CertFreeCertificateContext
CryptStringToBinaryA
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertEnumCertificatesInStore
CertFreeCertificateChain
wldap32
ord143
ord217
ord46
ord211
ord60
ord45
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ws2_32
connect
WSACreateEvent
WSAGetLastError
getpeername
recv
closesocket
WSACloseEvent
getsockname
getsockopt
htons
ntohs
setsockopt
socket
WSASetLastError
WSAIoctl
WSAStartup
WSACleanup
accept
htonl
listen
ioctlsocket
__WSAFDIsSet
select
getaddrinfo
send
WSAEnumNetworkEvents
WSAEventSelect
recvfrom
sendto
gethostname
ntohl
bind
freeaddrinfo
normaliz
IdnToAscii
Sections
.text Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 346KB - Virtual size: 346KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 23KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 53KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ