XPLOR V2[.]3[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

XPLOR V2.3.zip
Size

1.1MB
MD5

71170c0755b82490d5f1f2cb14e02ae8
SHA1

841c4b21362a44a76b99570f04914b307fe4a001
SHA256

4c93b10e44ead85e2573992ffc3fa1ed64b1477123e041c3a4affcef1438b4bf
SHA512

5d53b6cf74f52a971216242fbd60a491ea1dca4c993e58211e0b3359d43c038d1527479d1d0c99035389cd563f9d620bb0889157b929df21695eb0548a12edf6
SSDEEP

24576:Cbt7oseUXn8mEWPbLgZL+7oKLj+5s4cMAaqHO5FRj9xF49nJsJ6:StsI8PWjfGv/quXB9xizT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/XPLOR V2.3/XPLOR V2.3.exe

Files

XPLOR V2.3.zip
.zip

Password: Xplor
XPLOR V2.3/READ_ME.txt
XPLOR V2.3/XPLOR V2.3.exe
.exe windows:6 windows x64 arch:x64

Password: Xplor

caeb4eaaf6ccfff5fbaacfb921f8b0d7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

d3d9

Direct3DCreate9

kernel32

HeapAlloc
K32EnumProcesses
GetThreadContext
GetProcessHeap
GlobalMemoryStatusEx
GetModuleHandleW
CreateProcessA
GetStdHandle
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetModuleHandleA
GetLocaleInfoA
LoadLibraryA
CreateFileA
GetFileSizeEx
ReadFile
MapViewOfFile
UnmapViewOfFile
QueryPerformanceFrequency
CreateFileMappingA
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetProcAddress
VerSetConditionMask
WakeAllConditionVariable
SleepConditionVariableSRW
FreeLibrary
UnhandledExceptionFilter
GetSystemInfo
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetModuleFileNameA
CloseHandle
SetLastError
FormatMessageW
Process32FirstW
lstrcpyA
GetCurrentThread
Process32NextW
GetTickCount64
Sleep
GetTickCount
EnterCriticalSection
PeekNamedPipe
GetEnvironmentVariableA
WaitForSingleObjectEx
MoveFileExA
GetSystemDirectoryA
WaitForMultipleObjects
SleepEx
VerifyVersionInfoW
HeapFree
GetFileType
GetCurrentProcess
InitializeProcThreadAttributeList
DeleteCriticalSection
InitializeCriticalSectionEx
lstrlenA
GetFileAttributesW
OpenProcess
SetFileAttributesW
DeleteProcThreadAttributeList
UpdateProcThreadAttribute
GetLastError
QueryPerformanceCounter
K32GetModuleFileNameExA
LeaveCriticalSection
CreateToolhelp32Snapshot

user32

CloseClipboard
SetCursorPos
EmptyClipboard
ReleaseCapture
IsWindowUnicode
GetClipboardData
GetCursorPos
SetCapture
LoadCursorW
GetForegroundWindow
GetKeyboardLayout
TrackMouseEvent
ClientToScreen
GetCapture
ScreenToClient
SetCursor
SetClipboardData
OpenClipboard
GetClientRect
DefWindowProcW
DestroyWindow
CreateWindowExW
GetSystemMetrics
UnregisterClassW
RegisterClassExW
ShowWindow
DispatchMessageW
PeekMessageW
SetLayeredWindowAttributes
TranslateMessage
PostQuitMessage
UpdateWindow
GetKeyState
GetMessageExtraInfo

advapi32

CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
RegCloseKey

shell32

SHGetFolderPathW

msvcp140

?good@ios_base@std@@QEBA_NXZ
_Query_perf_frequency
?_Throw_Cpp_error@std@@YAXH@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Random_device@std@@YAIXZ
_Cnd_do_broadcast_at_thread_exit
_Query_perf_counter
_Thrd_detach
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?uncaught_exceptions@std@@YAHXZ

imm32

ImmGetContext
ImmReleaseContext
ImmSetCandidateWindow
ImmSetCompositionWindow

shlwapi

PathFindFileNameA

ntdll

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

d3dx9_43

D3DXCreateTextureFromFileInMemoryEx

wininet

InternetOpenA
InternetOpenUrlA
InternetCloseHandle
InternetReadFile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate
strstr
strrchr
longjmp
memcpy
__std_exception_destroy
memmove
memset
strchr
__current_exception_context
__current_exception
_CxxThrowException
__intrinsic_setjmp
__C_specific_handler
memcmp
memchr
__std_exception_copy

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode
realloc
malloc
_callnewh
calloc

api-ms-win-crt-stdio-l1-1-0

__p__commode
fputs
feof
fputc
_open
fgets
fopen
_lseeki64
__stdio_common_vsscanf
fread
_wfopen
fwrite
__stdio_common_vfprintf
fseek
fclose
fflush
__acrt_iob_func
ftell
_fseeki64
_set_fmode
__stdio_common_vsprintf
_write
_fileno
_close
_read

api-ms-win-crt-string-l1-1-0

_strdup
_wcsicmp
tolower
strncmp
strncpy
_strlwr
isdigit
strspn
strpbrk
strcmp
strcspn

api-ms-win-crt-runtime-l1-1-0

_wassert
_invalid_parameter_noinfo_noreturn
exit
_beginthreadex
terminate
_errno
strerror
__sys_nerr
__sys_errlist
_configure_narrow_argv
_register_thread_local_exe_atexit_callback
_c_exit
__p___argv
__p___argc
_initialize_narrow_environment
_exit
_initterm_e
_initterm
_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

wcstombs
strtol
strtoul
atoi
strtoll

api-ms-win-crt-math-l1-1-0

_fdopen
__setusermatherr
acosf
ceilf
cosf
fmodf
powf
roundf
sinf
sqrtf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-time-l1-1-0

strftime
_gmtime64
_time64

api-ms-win-crt-filesystem-l1-1-0

_access
_stat64
_fstat64
_unlink

bcrypt

BCryptGenRandom

normaliz

IdnToAscii
IdnToUnicode

ws2_32

WSACloseEvent
setsockopt
WSACleanup
send
WSAEnumNetworkEvents
WSAStartup
getsockopt
htons
WSAEventSelect
WSASetLastError
socket
__WSAFDIsSet
select
accept
WSAResetEvent
bind
WSAWaitForMultipleEvents
connect
closesocket
WSACreateEvent
WSAGetLastError
getsockname
htonl
listen
recv
getaddrinfo
WSAIoctl
gethostname
ioctlsocket
freeaddrinfo
recvfrom
sendto
getpeername
ntohs

wldap32

ord301
ord217
ord30
ord79
ord46
ord35
ord211
ord60
ord200
ord45
ord50
ord41
ord143
ord33
ord22
ord26
ord27
ord32

crypt32

CertGetNameStringA
CryptQueryObject
CertCloseStore
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertOpenStore
CertCreateCertificateChainEngine

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 318KB - Virtual size: 317KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 627KB - Virtual size: 640KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: Xplor

Password: Xplor

caeb4eaaf6ccfff5fbaacfb921f8b0d7

Headers

DLL Characteristics

File Characteristics

Imports

d3d9

kernel32

user32

advapi32

shell32

msvcp140

imm32

shlwapi

ntdll

d3dx9_43

wininet

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

bcrypt

normaliz

ws2_32

wldap32

crypt32

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 318KB - Virtual size: 317KB

.data Size: 627KB - Virtual size: 640KB

.pdata Size: 54KB - Virtual size: 54KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 318KB - Virtual size: 317KB

.data
Size: 627KB - Virtual size: 640KB

.pdata
Size: 54KB - Virtual size: 54KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 5KB - Virtual size: 4KB