82594f5ec0be4e56b1d797495996600f_Engine[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
82594f5ec0be4e56b1d797495996600f_Engine.exe
Size 6.0MB
Sample260507-19wknsbt21
SHA256 468f23cfef27e659fda7842961ee04b80110722449da0b6d40aef2dab89be5ee
MD5 ed435d4181e045170a179860f305e90a
SHA1 f3bfaa0d522dbc281a8e46275a21b643d2b01571
SHA512 97d3a0d0f9ae39e9396814ad7e0e542d8199a21bd5287506bb36c33ee992292f9df47751ce31c6a8a551de46f93370a9433c245fe451c77c7b9aec7af618b984
SSDEEP 49152:qGtlqbIU6iRrVwASOTLqKRhQWCboZC7HNFMLBql4vSDaqH2wveHqV51r3bBxYQiE:v+JLqFD/e6NBlLuWbXnxJtWTQ1Un
TLSH
T1D356BE69A9BC00D5E87A967AC28A5337D771BD1417B007CF2794ABE60F23AD01E7B740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
sample	embeds_openssl

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
82594f5ec0be4e56b1d797495996600f_Engine.exe

File Explorer

82594f5ec0be4e56b1d797495996600f_Engine.exe

.exe 6.0MB

82594f5ec0be4e56b1d797495996600f_Engine.exe

IMPHASH 2cf50f5101d1a1fb3f23083f210538de
SHA256 468f23cfef27e659fda7842961ee04b80110722449da0b6d40aef2dab89be5ee
MD5 ed435d4181e045170a179860f305e90a
SHA1 f3bfaa0d522dbc281a8e46275a21b643d2b01571
SHA512 97d3a0d0f9ae39e9396814ad7e0e542d8199a21bd5287506bb36c33ee992292f9df47751ce31c6a8a551de46f93370a9433c245fe451c77c7b9aec7af618b984
SSDEEP 49152:qGtlqbIU6iRrVwASOTLqKRhQWCboZC7HNFMLBql4vSDaqH2wveHqV51r3bBxYQiE:v+JLqFD/e6NBlLuWbXnxJtWTQ1Un
TLSH
T1D356BE69A9BC00D5E87A967AC28A5337D771BD1417B007CF2794ABE60F23AD01E7B740
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Embeds OpenSSL

Embeds OpenSSL, may be used to circumvent TLS interception.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2308044

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\User\source\repos\Horizon-V3-\x64\Release\Engine.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

ws2_32

getsockopt send getaddrinfo WSACloseEvent socket sendto recvfrom htons connect closesocket WSACreateEvent WSACleanup WSAStartup shutdown WSAEnumNetworkEvents WSAEventSelect WSAResetEvent getservbyname getservbyport gethostbyaddr inet_addr freeaddrinfo inet_ntoa gethostbyname WSAWaitForMultipleEvents WSASetLastError WSAGetLastError ntohs gethostname ioctlsocket getpeername recv setsockopt WSAIoctl __WSAFDIsSet select accept listen htonl bind getsockname

normaliz

IdnToUnicode IdnToAscii

advapi32

CryptDestroyHash DeregisterEventSource CryptGetHashParam RegisterEventSourceW ReportEventW CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptSignHashW CryptEnumProvidersW CryptGenRandom CryptHashData CryptReleaseContext CryptCreateHash CryptAcquireContextW CryptAcquireContextA CryptDestroyKey CryptImportKey CryptEncrypt

crypt32

PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringA CryptQueryObject CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertOpenSystemStoreW CertGetCertificateContextProperty CertDuplicateCertificateContext CertCreateCertificateChainEngine

wldap32

ord26 ord41 ord50 ord45 ord60 ord211 ord46 ord217 ord22 ord27 ord32 ord33 ord35 ord79 ord30 ord200 ord143 ord301

kernel32

AreFileApisANSI GetFileAttributesExW GetFileAttributesW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx SleepConditionVariableSRW WakeAllConditionVariable UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetSystemTimeAsFileTime InitializeSListHead WriteFile InitializeSRWLock TlsAlloc TlsGetValue TlsSetValue TlsFree GetEnvironmentVariableW GetModuleHandleExW GetACP GetTickCount64 K32GetModuleFileNameExW OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle ExitProcess K32EnumProcessModules Module32FirstW WideCharToMultiByte Module32NextW SetThreadPriority GetCurrentThread SetConsoleTextAttribute GetStdHandle GetConsoleWindow AllocConsole GetCurrentProcessId SetUnhandledExceptionFilter CreateFileW lstrcmpiW VirtualFree GetCurrentThreadId GetModuleHandleA GetProcAddress GetTempPathW LocalFree FormatMessageA WriteProcessMemory ReadProcessMemory GetCurrentProcess GetVolumeInformationW GetComputerNameExW GetSystemInfo GetLocalTime MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency VerSetConditionMask FreeLibrary QueryPerformanceCounter GetModuleHandleW ReleaseSRWLockExclusive AcquireSRWLockExclusive SetLastError FormatMessageW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SetEvent WaitForSingleObject CreateEventA GetSystemDirectoryA Sleep MoveFileExA WaitForSingleObjectEx GetEnvironmentVariableA GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects SleepEx VerifyVersionInfoW CreateFileA GetFileSizeEx AcquireSRWLockShared InitializeCriticalSection ReleaseSemaphore GetExitCodeThread CreateSemaphoreA LoadLibraryW GetSystemTime SystemTimeToFileTime GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW CreateEventW GetProcessHeap HeapFree InterlockedPushEntrySList HeapAlloc GetFileInformationByHandleEx GetLastError ReleaseSRWLockShared GetTickCount

user32

DispatchMessageW PeekMessageW SetWindowDisplayAffinity SetLayeredWindowAttributes TranslateMessage PostQuitMessage UpdateWindow GetKeyState GetMessageExtraInfo GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout LoadCursorW SetCapture SetCursor GetClientRect CreateWindowExW IsWindowUnicode ReleaseCapture DestroyWindow DefWindowProcW MapVirtualKeyA SendInput GetCursorPos RegisterClassExW GetForegroundWindow ScreenToClient FindWindowW GetAsyncKeyState MessageBoxW ShowWindow SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetProcessWindowStation GetUserObjectInformationW SetWindowLongW SetClipboardData GetClipboardData GetKeyNameTextA UnregisterClassW FindWindowA GetSystemMetrics

shell32

ShellExecuteW

msvcp140

?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Xinvalid_argument@std@@YAXPEBD@Z _Thrd_join ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Random_device@std@@YAIXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z _Query_perf_frequency ?_Xlength_error@std@@YAXPEBD@Z _Query_perf_counter ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A _Cnd_do_broadcast_at_thread_exit ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?good@ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?_Xbad_function_call@std@@YAXXZ _Mtx_lock _Mtx_unlock ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z _Thrd_id ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

ntdll

RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext

winhttp

WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpOpen WinHttpReceiveResponse WinHttpQueryDataAvailable

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

dwmapi

DwmExtendFrameIntoClientArea

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException memcmp memcpy memmove memset strrchr memchr __current_exception __current_exception_context strchr __std_exception_destroy __std_exception_copy strstr __std_terminate __std_type_info_compare wcsstr __C_specific_handler

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode realloc malloc free calloc

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-math-l1-1-0

__setusermatherr fmodf powf roundf fmod _dsign _fdopen ceilf sinf atan2f acosf _hypotf sqrtf cosf hypot sin

api-ms-win-crt-runtime-l1-1-0

_errno _beginthreadex terminate _invalid_parameter_noinfo_noreturn signal abort _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _invalid_parameter_noinfo _exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv __sys_errlist __sys_nerr strerror_s raise exit

api-ms-win-crt-stdio-l1-1-0

fputs ferror _lseeki64 _set_fmode fopen fflush fclose clearerr _read fseek __stdio_common_vsscanf _wfopen _setmode __acrt_iob_func _close __stdio_common_vsprintf_s __p__commode _write fgets __stdio_common_vfprintf _get_stream_buffer_pointers _fseeki64 fsetpos ungetc setvbuf fgetpos _open __stdio_common_vswprintf fgetc fputc ftell fread feof _lseek fwrite _fileno __stdio_common_vsprintf

api-ms-win-crt-string-l1-1-0

tolower strncpy_s strncpy strncmp isspace _stricmp strcspn strpbrk strspn strcmp _strdup strcpy_s strcat_s _wcsicmp iswspace isdigit

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64_s _gmtime64 strftime

api-ms-win-crt-convert-l1-1-0

strtod strtol strtoll strtoull strtoul atoi atof wcstombs

api-ms-win-crt-filesystem-l1-1-0

_lock_file _stat64 _fstat64 _access _unlock_file _stat64i32 _unlink

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv ___lc_codepage_func

api-ms-win-crt-environment-l1-1-0

getenv

ole32

CoCreateFreeThreadedMarshaler

oleaut32

SetErrorInfo GetErrorInfo SysStringLen SysAllocString SysFreeString