General

  • Target

    Forlorn.rar

  • Size

    117.6MB

  • MD5

    f7ce5e6573558bf1eda5df74fe79e987

  • SHA1

    45c818e5a1e06b230a8cb9f3e440e9294e4391a6

  • SHA256

    fcd1be5fc1ee9a718b876917c09d7541c3ae4657b183ed4def2d43b801f2876c

  • SHA512

    3a8129edb6f6b4e416c5440e6cfc63e5d1d6291e0b01c3fce718f6ec83244a1b785eea69e49cac0462cae3dad918bd65ef00ace398399c8b16d4f7af821a830b

  • SSDEEP

    3145728:CxhOpI0mSzKILYGJs2fiokezc3IFoZCTBPWkD+usm/Bz5:CgBmwKIL3s2fioXz2ZaWQs65

Score
3/10

Malware Config

Signatures

  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Unsigned PE 22 IoCs

    Checks for missing Authenticode signature.

Files

  • Forlorn.rar
    .rar
  • Forlorn/CefSharp.BrowserSubprocess.Core.dll
    .dll windows:6 windows x64 arch:x64

    381caaeb3e8c799e870352645b9bd639


    Headers

    Imports

    Exports

    Sections

  • Forlorn/CefSharp.BrowserSubprocess.Core.pdb
  • Forlorn/CefSharp.BrowserSubprocess.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • Forlorn/CefSharp.BrowserSubprocess.pdb
  • Forlorn/CefSharp.Core.Runtime.dll
    .dll windows:6 windows x64 arch:x64

    c85fcf9507fdde296c1f7008675cadeb


    Headers

    Imports

    Exports

    Sections

  • Forlorn/CefSharp.Core.Runtime.pdb
  • Forlorn/CefSharp.Core.Runtime.xml
    .js .xml polyglot
  • Forlorn/CefSharp.Core.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Forlorn/CefSharp.Core.pdb
  • Forlorn/CefSharp.Core.xml
    .js .xml polyglot
  • Forlorn/CefSharp.WinForms.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Forlorn/CefSharp.WinForms.pdb
  • Forlorn/CefSharp.WinForms.xml
    .xml
  • Forlorn/CefSharp.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Forlorn/CefSharp.pdb
  • Forlorn/CefSharp.xml
    .xml
  • Forlorn/Confused/Forlorn.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • Forlorn/Forlorn.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • Forlorn/ForlornApi.dll
    .dll windows:4 windows x64 arch:x64


    Headers

    Sections

  • Forlorn/ScintillaNET.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Forlorn/Scripts/test.txt
  • Forlorn/Siticone.Desktop.UI.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Forlorn/Siticone.UI.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Forlorn/Unnamed.crproj
  • Forlorn/bin/ForlornInject.dll
    .dll windows:6 windows x64 arch:x64

    3a1f9d973bff43051a3daf411f707362


    Headers

    Imports

    Exports

    Sections

  • Forlorn/bin/libcrypto-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    680b5c239d82da8e527bf24b921948fd


    Headers

    Imports

    Exports

    Sections

  • Forlorn/bin/libssl-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    1dedd757946c1ca3c32f97146f7a6c25


    Headers

    Imports

    Exports

    Sections

  • Forlorn/bin/xxhash.dll
    .dll windows:6 windows x64 arch:x64

    fba6b233846a2ea5e6907e23b2de9a26


    Headers

    Imports

    Exports

    Sections

  • Forlorn/bin/zstd.dll
    .dll windows:6 windows x64 arch:x64

    f32e8587cacdf9095c309b87f2877ebb


    Headers

    Imports

    Exports

    Sections

  • Forlorn/chrome_100_percent.pak
  • Forlorn/chrome_200_percent.pak
  • Forlorn/chrome_elf.dll
    .dll windows:10 windows x64 arch:x64

    e263be4826fcf2e67fd6d76da23e13e1


    Headers

    Imports

    Exports

    Sections

  • Forlorn/d3dcompiler_47.dll
    .dll windows:10 windows x64 arch:x64

    8235041cfd6fffb926142c2c78013446


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Forlorn/debug.log
  • Forlorn/dxcompiler.dll
    .dll windows:10 windows x64 arch:x64

    ab3093cf1cff53f421cecf4eeee429f4


    Headers

    Imports

    Exports

    Sections

  • Forlorn/dxil.dll
    .dll windows:10 windows x64 arch:x64

    42e0b0387affe2aaa84bcec72eb74baf


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Forlorn/icudtl.dat
  • Forlorn/libEGL.dll
    .dll windows:10 windows x64 arch:x64

    9a96e9625913c28565890e319d5bf446


    Headers

    Imports

    Exports

    Sections

  • Forlorn/libGLESv2.dll
    .dll windows:10 windows x64 arch:x64

    8493b5852f29b95099711891808f02c6


    Headers

    Imports

    Exports

    Sections

  • Forlorn/libcef.dll
    .dll windows:10 windows x64 arch:x64

    ce2d5b15ef58d137305afaf1265f1871


    Headers

    Imports

    Exports

    Sections

  • Forlorn/locales/af.pak
  • Forlorn/locales/am.pak
  • Forlorn/locales/ar.pak
  • Forlorn/locales/bg.pak
  • Forlorn/locales/bn.pak
  • Forlorn/locales/ca.pak
  • Forlorn/locales/cs.pak
  • Forlorn/locales/da.pak
  • Forlorn/locales/de.pak
  • Forlorn/locales/el.pak
  • Forlorn/locales/en-GB.pak
  • Forlorn/locales/en-US.pak
  • Forlorn/locales/es-419.pak
  • Forlorn/locales/es.pak
  • Forlorn/locales/et.pak
  • Forlorn/locales/fa.pak
  • Forlorn/locales/fi.pak
  • Forlorn/locales/fil.pak
  • Forlorn/locales/fr.pak
  • Forlorn/locales/gu.pak
  • Forlorn/locales/he.pak
  • Forlorn/locales/hi.pak
  • Forlorn/locales/hr.pak
  • Forlorn/locales/hu.pak
  • Forlorn/locales/id.pak
  • Forlorn/locales/it.pak
  • Forlorn/locales/ja.pak
  • Forlorn/locales/kn.pak
  • Forlorn/locales/ko.pak
  • Forlorn/locales/lt.pak
  • Forlorn/locales/lv.pak
  • Forlorn/locales/ml.pak
  • Forlorn/locales/mr.pak
  • Forlorn/locales/ms.pak
  • Forlorn/locales/nb.pak
  • Forlorn/locales/nl.pak
  • Forlorn/locales/pl.pak
  • Forlorn/locales/pt-BR.pak
  • Forlorn/locales/pt-PT.pak
  • Forlorn/locales/ro.pak
  • Forlorn/locales/ru.pak
  • Forlorn/locales/sk.pak
  • Forlorn/locales/sl.pak
  • Forlorn/locales/sr.pak
  • Forlorn/locales/sv.pak
  • Forlorn/locales/sw.pak
  • Forlorn/locales/ta.pak
  • Forlorn/locales/te.pak
  • Forlorn/locales/th.pak
  • Forlorn/locales/tr.pak
  • Forlorn/locales/uk.pak
  • Forlorn/locales/ur.pak
  • Forlorn/locales/vi.pak
  • Forlorn/locales/zh-CN.pak
  • Forlorn/locales/zh-TW.pak
  • Forlorn/resources.pak
  • Forlorn/snapshot_blob.bin
  • Forlorn/v8_context_snapshot.bin
  • Forlorn/vk_swiftshader.dll
    .dll windows:10 windows x64 arch:x64

    cff2e3bc77a72caa699e7cda3a0c38d8


    Headers

    Imports

    Exports

    Sections

  • Forlorn/vk_swiftshader_icd.json
  • Forlorn/vulkan-1.dll
    .dll windows:10 windows x64 arch:x64

    4281dc6a4061c17c72b1d64db5243928


    Headers

    Imports

    Exports

    Sections

  • Forlorn/workspace/IY_FE.iy
  • Forlorn/workspace/Scripts/test.txt