Forlornicus[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Forlornicus.exe
Size

1.9MB
MD5

aef9639591c88cd2f6e8586907ac5fb4
SHA1

503069f0b721bb6cfffd7cbdc1714a70c0b4de55
SHA256

a975f3d4a9f8574d946b9c0add6b0847a184e400520ffb61297b8225e9e01e91
SHA512

11b5dd4de6137423329629a7d85d62b3ddbc2812d17916c6d0b8f34d46a3004de7daab68e6e36682436f87367f2f6ddda4c443fc13a94e41f59fca9c3fe9d5f0
SSDEEP

49152:6x7LYiN0vwSygPS6lC1xxwWvJ4+0gKs1fdRRr:6xgoSy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Forlornicus.exe

Files

Forlornicus.exe
.exe windows:6 windows x64 arch:x64

ddf5b998129fc3e333011e86f1ebafb0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\capta\source\repos\ForlornInternal\build\Release\net8.0-windows\Forlornicus.pdb

Imports

libcrypto-3-x64

X509_get_ext_d2i
ASN1_STRING_length
X509_free
BIO_new_socket
EVP_sha512
ASN1_STRING_get0_data
OPENSSL_sk_value
EVP_DigestInit_ex
EVP_MD_CTX_free
GENERAL_NAMES_free
EVP_DigestUpdate
EVP_DigestFinal_ex
EVP_sha256
EVP_md5
X509_get_subject_name
OPENSSL_sk_num
X509_STORE_add_cert
d2i_X509
EVP_MD_CTX_new
X509_NAME_get_text_by_NID
X509_STORE_free
OPENSSL_thread_stop
BIO_ctrl

libssl-3-x64

SSL_write
SSL_CTX_new
SSL_CTX_use_PrivateKey_file
SSL_CTX_use_certificate_file
SSL_CTX_set_cert_store
SSL_CTX_free
SSL_new
SSL_CTX_set_default_verify_paths
SSL_CTX_get_cert_store
SSL_free
OPENSSL_init_ssl
SSL_connect
SSL_peek
SSL_get_verify_result
TLS_client_method
SSL_CTX_set_default_passwd_cb_userdata
SSL_ctrl
SSL_set_bio
SSL_pending
SSL_read
SSL_set_verify
SSL_CTX_load_verify_locations
SSL_get1_peer_certificate
SSL_shutdown
SSL_get_error

zstd

ZSTD_compress
ZSTD_decompress
ZSTD_isError
ZSTD_getErrorName
ZSTD_maxCLevel
ZSTD_compressBound

xxhash

XXH32

kernel32

GetOEMCP
GetACP
IsValidCodePage
ReadConsoleW
ReadFile
CreateProcessW
WaitForSingleObject
GetProcessHeap
HeapQueryInformation
HeapReAlloc
HeapFree
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
VirtualProtect
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetFilePointerEx
WriteConsoleW
OutputDebugStringW
GetFileType
GetCommandLineW
GetCommandLineA
WriteFile
GetStdHandle
ExitProcess
GetSystemInfo
HeapValidate
HeapSize
HeapAlloc
FreeLibraryAndExitThread
ExitThread
CreateThread
GetModuleFileNameW
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
GetProcAddress
QueryPerformanceFrequency
QueryPerformanceCounter
GetModuleFileNameA
GetFileSizeEx
SetConsoleTitleA
CreateFile2
UnmapViewOfFile
GlobalAlloc
GlobalFree
CloseHandle
FreeConsole
GetEnvironmentStringsW
GlobalLock
MapViewOfFileFromApp
GlobalUnlock
AllocConsole
SizeofResource
GetModuleHandleExW
GetProcessId
OpenProcess
CreateToolhelp32Snapshot
Sleep
GetLastError
Process32NextW
K32GetProcessMemoryInfo
QueryFullProcessImageNameA
LockResource
Process32FirstW
LoadResource
FindResourceW
VirtualProtectEx
VirtualAllocEx
VirtualQueryEx
LoadLibraryA
GetCurrentProcessId
GetExitCodeProcess
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
RtlUnwindEx
GetStringTypeW
GetCPInfo
CompareStringEx
DecodePointer
EncodePointer
FreeEnvironmentStringsW
SetEnvironmentVariableW
LCMapStringEx
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
TryAcquireSRWLockExclusive
InitOnceBeginInitialize
InitOnceComplete
GetLocaleInfoEx
FormatMessageA
LocalFree
SetStdHandle
SetEndOfFile
CreateFileMappingFromApp
RtlCaptureContext
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlUnwind
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
WakeConditionVariable
WaitForSingleObjectEx
GetExitCodeThread
GetNativeSystemInfo
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
SetFileInformationByHandle
GetTempPathW
AreFileApisANSI
CopyFileW
GetFileInformationByHandleEx
MultiByteToWideChar
WideCharToMultiByte
RtlPcToFileHeader
RaiseException

user32

OpenClipboard
SetForegroundWindow
EnumWindows
GetForegroundWindow
keybd_event
MapVirtualKeyW
GetWindowThreadProcessId
EmptyClipboard
SetClipboardData
CloseClipboard

advapi32

GetCurrentHwProfileW

ole32

CoCreateGuid

ws2_32

WSAStartup
getpeername
getsockname
send
socket
ntohs
inet_pton
recv
getsockopt
freeaddrinfo
ioctlsocket
getnameinfo
setsockopt
WSAGetLastError
WSASocketW
WSAAccept
getaddrinfo
listen
shutdown
select
closesocket
bind
__WSAFDIsSet
WSACleanup
connect

crypt32

CertFreeCertificateContext
CertOpenSystemStoreW
CertEnumCertificatesInStore
CertCloseStore

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 350KB - Virtual size: 350KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 47KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fptable
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ddf5b998129fc3e333011e86f1ebafb0

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libcrypto-3-x64

libssl-3-x64

zstd

xxhash

kernel32

user32

advapi32

ole32

ws2_32

crypt32

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 350KB - Virtual size: 350KB

.data Size: 47KB - Virtual size: 62KB

.pdata Size: 54KB - Virtual size: 53KB

.fptable Size: 512B - Virtual size: 256B

.rsrc Size: 74KB - Virtual size: 73KB

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 350KB - Virtual size: 350KB

.data
Size: 47KB - Virtual size: 62KB

.pdata
Size: 54KB - Virtual size: 53KB

.fptable
Size: 512B - Virtual size: 256B

.rsrc
Size: 74KB - Virtual size: 73KB

.reloc
Size: 7KB - Virtual size: 7KB