General

  • Target

    Debug.zip

  • Size

    5.7MB

  • MD5

    2945e8286fa4fb0ed7ce792f0c0b086b

  • SHA1

    8eb9c2982e57aec6fc6b29cabb12d9adea8594b5

  • SHA256

    18ebb61caa36050ef3e8845a21c313b068f5d04e609e95f638455948221e93f4

  • SHA512

    1f28f19cd0fb31c169c4d838b241549049a90b2af01077e3371b1acec0224e42d106b650cb4fc14d2d484f2f985a7a2f10a0353c8f08b3a3d72118dddc2125f9

  • SSDEEP

    98304:aA2tiVNp0oIytptC57HQqY/EhvAADr3orlpLQL834yBaDO5IagA861ve8mVrNNoo:giGoR/tC71CtOomKbyCjgA86v2FNNoHI

Score
3/10

Malware Config

Signatures

  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Unsigned PE 8 IoCs

    Checks for missing Authenticode signature.

Files

  • Debug.zip
    .zip
  • Debug/Editor/Monaco.html
    .html .js polyglot
  • Debug/Editor/info.evon
  • Debug/Editor/tabs/New Tab 1
  • Debug/Editor/theme.evon
  • Debug/Editor/vs/base/worker/workerMain.js
    .js
  • Debug/Editor/vs/basic-languages/bat/bat.js
  • Debug/Editor/vs/basic-languages/coffee/coffee.js
  • Debug/Editor/vs/basic-languages/cpp/cpp.js
  • Debug/Editor/vs/basic-languages/csharp/csharp.js
  • Debug/Editor/vs/basic-languages/csp/csp.js
  • Debug/Editor/vs/basic-languages/css/css.js
  • Debug/Editor/vs/basic-languages/dockerfile/dockerfile.js
  • Debug/Editor/vs/basic-languages/fsharp/fsharp.js
  • Debug/Editor/vs/basic-languages/go/go.js
  • Debug/Editor/vs/basic-languages/handlebars/handlebars.js
    .js
  • Debug/Editor/vs/basic-languages/html/html.js
    .js
  • Debug/Editor/vs/basic-languages/ini/ini.js
  • Debug/Editor/vs/basic-languages/java/java.js
  • Debug/Editor/vs/basic-languages/less/less.js
  • Debug/Editor/vs/basic-languages/lua/lua.js
  • Debug/Editor/vs/basic-languages/markdown/markdown.js
    .js
  • Debug/Editor/vs/basic-languages/msdax/msdax.js
  • Debug/Editor/vs/basic-languages/mysql/mysql.js
  • Debug/Editor/vs/basic-languages/objective-c/objective-c.js
  • Debug/Editor/vs/basic-languages/pgsql/pgsql.js
  • Debug/Editor/vs/basic-languages/php/php.js
  • Debug/Editor/vs/basic-languages/postiats/postiats.js
  • Debug/Editor/vs/basic-languages/powershell/powershell.js
  • Debug/Editor/vs/basic-languages/pug/pug.js
  • Debug/Editor/vs/basic-languages/python/python.js
  • Debug/Editor/vs/basic-languages/r/r.js
  • Debug/Editor/vs/basic-languages/razor/razor.js
    .js
  • Debug/Editor/vs/basic-languages/redis/redis.js
  • Debug/Editor/vs/basic-languages/redshift/redshift.js
  • Debug/Editor/vs/basic-languages/ruby/ruby.js
  • Debug/Editor/vs/basic-languages/rust/rust.js
  • Debug/Editor/vs/basic-languages/sb/sb.js
  • Debug/Editor/vs/basic-languages/scss/scss.js
  • Debug/Editor/vs/basic-languages/solidity/solidity.js
  • Debug/Editor/vs/basic-languages/sql/sql.js
  • Debug/Editor/vs/basic-languages/st/st.js
  • Debug/Editor/vs/basic-languages/swift/swift.js
  • Debug/Editor/vs/basic-languages/vb/vb.js
  • Debug/Editor/vs/basic-languages/xml/xml.js
  • Debug/Editor/vs/basic-languages/yaml/yaml.js
  • Debug/Editor/vs/editor/contrib/suggest/media/String_16x.svg
  • Debug/Editor/vs/editor/contrib/suggest/media/String_inverse_16x.svg
  • Debug/Editor/vs/editor/editor.main.css
  • Debug/Editor/vs/editor/editor.main.js
    .js
  • Debug/Editor/vs/editor/editor.main.nls.de.js
  • Debug/Editor/vs/editor/editor.main.nls.es.js
  • Debug/Editor/vs/editor/editor.main.nls.fr.js
  • Debug/Editor/vs/editor/editor.main.nls.it.js
  • Debug/Editor/vs/editor/editor.main.nls.ja.js
  • Debug/Editor/vs/editor/editor.main.nls.js
  • Debug/Editor/vs/editor/editor.main.nls.ko.js
  • Debug/Editor/vs/editor/editor.main.nls.ru.js
  • Debug/Editor/vs/editor/editor.main.nls.zh-cn.js
  • Debug/Editor/vs/editor/editor.main.nls.zh-tw.js
  • Debug/Editor/vs/editor/standalone/browser/quickOpen/symbol-sprite.svg
  • Debug/Editor/vs/language/css/cssMode.js
    .js
  • Debug/Editor/vs/language/css/cssWorker.js
    .js
  • Debug/Editor/vs/language/html/htmlMode.js
    .js
  • Debug/Editor/vs/language/html/htmlWorker.js
    .js
  • Debug/Editor/vs/language/json/jsonMode.js
    .js
  • Debug/Editor/vs/language/json/jsonWorker.js
    .js
  • Debug/Editor/vs/language/typescript/lib/typescriptServices.js
    .js
  • Debug/Editor/vs/language/typescript/tsMode.js
    .js
  • Debug/Editor/vs/language/typescript/tsWorker.js
    .js
  • Debug/Editor/vs/loader.js
    .js
  • Debug/ForlornApi.dll
    .dll windows:4 windows x64 arch:x64


    Headers

    Sections

  • Debug/Microsoft.Bcl.AsyncInterfaces.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Debug/Microsoft.Bcl.AsyncInterfaces.xml
    .xml
  • Debug/Microsoft.Web.WebView2.Core.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Debug/Microsoft.Web.WebView2.Core.xml
    .js .xml polyglot
  • Debug/Microsoft.Web.WebView2.WinForms.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Debug/Microsoft.Web.WebView2.WinForms.xml
    .xml
  • Debug/Newtonsoft.Json.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Debug/Newtonsoft.Json.xml
    .xml
  • Debug/System.Buffers.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Debug/System.Buffers.xml
  • Debug/System.Memory.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Debug/System.Memory.xml
  • Debug/System.Numerics.Vectors.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Debug/System.Numerics.Vectors.xml
  • Debug/System.Runtime.CompilerServices.Unsafe.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Debug/System.Runtime.CompilerServices.Unsafe.xml
  • Debug/System.Text.Encodings.Web.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Debug/System.Text.Encodings.Web.xml
  • Debug/System.Text.Json.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Debug/System.Text.Json.xml
  • Debug/System.Threading.Tasks.Extensions.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Debug/System.Threading.Tasks.Extensions.xml
  • Debug/System.ValueTuple.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Debug/System.ValueTuple.xml
    .xml
  • Debug/Testingz.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Debug/Testingz.exe.WebView2/EBWebView/Crashpad/settings.dat
  • Debug/Testingz.exe.WebView2/EBWebView/Crashpad/throttle_store.dat
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Cache/Cache_Data/data_0
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Cache/Cache_Data/data_1
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Cache/Cache_Data/data_2
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Cache/Cache_Data/data_3
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Cache/Cache_Data/index
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Code Cache/js/index
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Code Cache/js/index-dir/the-real-index
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Code Cache/wasm/index
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Code Cache/wasm/index-dir/the-real-index
  • Debug/Testingz.exe.WebView2/EBWebView/Default/DIPS
  • Debug/Testingz.exe.WebView2/EBWebView/Default/DawnGraphiteCache/data_0
  • Debug/Testingz.exe.WebView2/EBWebView/Default/DawnGraphiteCache/data_1
  • Debug/Testingz.exe.WebView2/EBWebView/Default/DawnGraphiteCache/data_2
  • Debug/Testingz.exe.WebView2/EBWebView/Default/DawnGraphiteCache/data_3
  • Debug/Testingz.exe.WebView2/EBWebView/Default/DawnGraphiteCache/index
  • Debug/Testingz.exe.WebView2/EBWebView/Default/DawnWebGPUCache/data_0
  • Debug/Testingz.exe.WebView2/EBWebView/Default/DawnWebGPUCache/data_1
  • Debug/Testingz.exe.WebView2/EBWebView/Default/DawnWebGPUCache/data_2
  • Debug/Testingz.exe.WebView2/EBWebView/Default/DawnWebGPUCache/data_3
  • Debug/Testingz.exe.WebView2/EBWebView/Default/DawnWebGPUCache/index
  • Debug/Testingz.exe.WebView2/EBWebView/Default/EdgeEDrop/EdgeEDropSQLite.db
  • Debug/Testingz.exe.WebView2/EBWebView/Default/EdgeHubAppUsage/EdgeHubAppUsageSQLite.db
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Extension Rules/000003.log
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Extension Rules/CURRENT
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Extension Rules/LOG
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Extension Rules/MANIFEST-000001
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Extension Scripts/000003.log
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Extension Scripts/CURRENT
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Extension Scripts/LOG
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Extension Scripts/MANIFEST-000001
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Extension State/000003.log
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Extension State/CURRENT
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Extension State/LOG
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Extension State/LOG.old
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Extension State/MANIFEST-000001
  • Debug/Testingz.exe.WebView2/EBWebView/Default/ExtensionActivityComp
  • Debug/Testingz.exe.WebView2/EBWebView/Default/ExtensionActivityEdge
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Favicons
  • Debug/Testingz.exe.WebView2/EBWebView/Default/GPUCache/data_0
  • Debug/Testingz.exe.WebView2/EBWebView/Default/GPUCache/data_1
  • Debug/Testingz.exe.WebView2/EBWebView/Default/GPUCache/data_2
  • Debug/Testingz.exe.WebView2/EBWebView/Default/GPUCache/data_3
  • Debug/Testingz.exe.WebView2/EBWebView/Default/GPUCache/index
  • Debug/Testingz.exe.WebView2/EBWebView/Default/History
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Local Storage/leveldb/CURRENT
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Local Storage/leveldb/LOG
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Local Storage/leveldb/LOG.old
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Local Storage/leveldb/MANIFEST-000001
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Login Data
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Network Action Predictor
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Network/Cookies
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Network/Network Persistent State
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Network/Reporting and NEL
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Network/SCT Auditing Pending Reports
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Network/Sdch Dictionaries
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Network/TransportSecurity
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Network/Trust Tokens
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Preferences
  • Debug/Testingz.exe.WebView2/EBWebView/Default/PreferredApps
  • Debug/Testingz.exe.WebView2/EBWebView/Default/README
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Safe Browsing Network/Safe Browsing Cookies
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Secure Preferences
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Session Storage/000003.log
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Session Storage/CURRENT
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Session Storage/LOG
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Session Storage/LOG.old
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Session Storage/MANIFEST-000001
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Shared Dictionary/cache/index
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Shared Dictionary/cache/index-dir/the-real-index
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Shared Dictionary/db
  • Debug/Testingz.exe.WebView2/EBWebView/Default/SharedStorage
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Site Characteristics Database/000003.log
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Site Characteristics Database/CURRENT
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Site Characteristics Database/LOG
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Site Characteristics Database/LOG.old
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Site Characteristics Database/MANIFEST-000001
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Sync Data/LevelDB/000003.log
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Sync Data/LevelDB/CURRENT
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Sync Data/LevelDB/LOG
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Sync Data/LevelDB/LOG.old
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Sync Data/LevelDB/MANIFEST-000001
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Top Sites
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Visited Links
  • Debug/Testingz.exe.WebView2/EBWebView/Default/Web Data
  • Debug/Testingz.exe.WebView2/EBWebView/Default/heavy_ad_intervention_opt_out.db
  • Debug/Testingz.exe.WebView2/EBWebView/Default/shared_proto_db/000003.log
  • Debug/Testingz.exe.WebView2/EBWebView/Default/shared_proto_db/CURRENT
  • Debug/Testingz.exe.WebView2/EBWebView/Default/shared_proto_db/LOG
  • Debug/Testingz.exe.WebView2/EBWebView/Default/shared_proto_db/LOG.old
  • Debug/Testingz.exe.WebView2/EBWebView/Default/shared_proto_db/MANIFEST-000001
  • Debug/Testingz.exe.WebView2/EBWebView/Default/shared_proto_db/metadata/000003.log
  • Debug/Testingz.exe.WebView2/EBWebView/Default/shared_proto_db/metadata/CURRENT
  • Debug/Testingz.exe.WebView2/EBWebView/Default/shared_proto_db/metadata/LOG
  • Debug/Testingz.exe.WebView2/EBWebView/Default/shared_proto_db/metadata/LOG.old
  • Debug/Testingz.exe.WebView2/EBWebView/Default/shared_proto_db/metadata/MANIFEST-000001
  • Debug/Testingz.exe.WebView2/EBWebView/GrShaderCache/data_0
  • Debug/Testingz.exe.WebView2/EBWebView/GrShaderCache/data_1
  • Debug/Testingz.exe.WebView2/EBWebView/GrShaderCache/data_2
  • Debug/Testingz.exe.WebView2/EBWebView/GrShaderCache/data_3
  • Debug/Testingz.exe.WebView2/EBWebView/GrShaderCache/f_000001
  • Debug/Testingz.exe.WebView2/EBWebView/GrShaderCache/index
  • Debug/Testingz.exe.WebView2/EBWebView/GraphiteDawnCache/data_0
  • Debug/Testingz.exe.WebView2/EBWebView/GraphiteDawnCache/data_1
  • Debug/Testingz.exe.WebView2/EBWebView/GraphiteDawnCache/data_2
  • Debug/Testingz.exe.WebView2/EBWebView/GraphiteDawnCache/data_3
  • Debug/Testingz.exe.WebView2/EBWebView/GraphiteDawnCache/index
  • Debug/Testingz.exe.WebView2/EBWebView/Last Version
  • Debug/Testingz.exe.WebView2/EBWebView/Local State
  • Debug/Testingz.exe.WebView2/EBWebView/ShaderCache/data_0
  • Debug/Testingz.exe.WebView2/EBWebView/ShaderCache/data_1
  • Debug/Testingz.exe.WebView2/EBWebView/ShaderCache/data_2
  • Debug/Testingz.exe.WebView2/EBWebView/ShaderCache/data_3
  • Debug/Testingz.exe.WebView2/EBWebView/ShaderCache/index
  • Debug/Testingz.exe.WebView2/EBWebView/SmartScreen/RemoteData/edgeSettings
  • Debug/Testingz.exe.WebView2/EBWebView/SmartScreen/RemoteData/edgeSettings_2.0-0
  • Debug/Testingz.exe.WebView2/EBWebView/Variations
  • Debug/Testingz.exe.config
  • Debug/Testingz.pdb
  • Debug/VisualStudioTabControl.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Debug/bin/ForlornInject.dll
    .dll windows:6 windows x64 arch:x64

    ac435dfa812fddee99bbf7a986186d1d


    Headers

    Imports

    Exports

    Sections

  • Debug/bin/libcrypto-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    680b5c239d82da8e527bf24b921948fd


    Headers

    Imports

    Exports

    Sections

  • Debug/bin/libssl-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    1dedd757946c1ca3c32f97146f7a6c25


    Headers

    Imports

    Exports

    Sections

  • Debug/bin/xxhash.dll
    .dll windows:6 windows x64 arch:x64

    fba6b233846a2ea5e6907e23b2de9a26


    Headers

    Imports

    Exports

    Sections

  • Debug/bin/zstd.dll
    .dll windows:6 windows x64 arch:x64

    f32e8587cacdf9095c309b87f2877ebb


    Headers

    Imports

    Exports

    Sections

  • Debug/runtimes/win-arm64/native/WebView2Loader.dll
  • Debug/runtimes/win-x64/native/WebView2Loader.dll
    .dll windows:10 windows x64 arch:x64

    f6946d311bccc86e2042a388e375de41


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Debug/runtimes/win-x86/native/WebView2Loader.dll
    .dll windows:10 windows x86 arch:x86

    72229ff546c74d09d9030ca49ce61b31


    Code Sign

    Headers

    Imports

    Exports

    Sections