Howl_patched[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Howl_patched.exe
Size 6.6MB
Sample260705-cebd9acs8p
SHA256 6e7d711f62cf7e3a3b03984f992c8e7cdb7de3e87c02d7514bcca95828c0f794
MD5 40d695ec8c90e57e43f4887c11e8bfe8
SHA1 a9a49db738f490b8d1c46f951862694a3126a63d
SHA512 763a3c71439f1532b742fd8d54db00f4666a92ae5af7c5e66d93826d18030c485efb8553addc564a2f7666346c49f9217466f7477ad27c964eaaf31f68f482b0
SSDEEP 196608:A9nHQ/x3mrbnHX0FAMwz988TtH0oNGR4r+mdg7PAmk01HLZqL1lFT:RR3FAMwz988TtH0oNGer+RPAmk01HYLd
TLSH
T19666BF47B39181ECD176D139CA86D767D3723C080B2156EB36DCAA1A6F736E04E7A702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Howl_patched.exe

File Explorer

Howl_patched.exe

.exe 6.6MB

Howl_patched.exe

IMPHASH 193fbb5ba33514f8ff3eb9fd890fd3c2
SHA256 6e7d711f62cf7e3a3b03984f992c8e7cdb7de3e87c02d7514bcca95828c0f794
MD5 40d695ec8c90e57e43f4887c11e8bfe8
SHA1 a9a49db738f490b8d1c46f951862694a3126a63d
SHA512 763a3c71439f1532b742fd8d54db00f4666a92ae5af7c5e66d93826d18030c485efb8553addc564a2f7666346c49f9217466f7477ad27c964eaaf31f68f482b0
SSDEEP 196608:A9nHQ/x3mrbnHX0FAMwz988TtH0oNGR4r+mdg7PAmk01HLZqL1lFT:RR3FAMwz988TtH0oNGer+RPAmk01HYLd
TLSH
T19666BF47B39181ECD176D139CA86D767D3723C080B2156EB36DCAA1A6F736E04E7A702
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2918208

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpQueryOption WinHttpSetOption WinHttpCrackUrl WinHttpAddRequestHeaders WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpConnect WinHttpQueryDataAvailable

crypt32

CertFreeCertificateContext

advapi32

CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptGenRandom

d3d11

D3D11CreateDeviceAndSwapChain

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

ntdll

RtlCaptureContext RtlLookupFunctionEntry VerSetConditionMask RtlPcToFileHeader RtlVirtualUnwind RtlUnwindEx RtlUnwind

d3dcompiler_47

D3DCompile

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary GetModuleHandleExW GetModuleHandleA FreeLibraryAndExitThread GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryExW

api-ms-win-core-localization-l1-2-0

GetUserDefaultLCID LCMapStringEx LCMapStringW IsValidCodePage GetCPInfo GetACP EnumSystemLocalesW IsValidLocale GetLocaleInfoEx GetLocaleInfoW FormatMessageA GetOEMCP GetLocaleInfoA

api-ms-win-core-string-l1-1-0

CompareStringEx MultiByteToWideChar CompareStringW GetStringTypeW WideCharToMultiByte

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency QueryPerformanceCounter

api-ms-win-core-heap-l2-1-0

GlobalFree LocalFree GlobalAlloc

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock GlobalLock

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW InitOnceBeginInitialize InitOnceComplete WakeAllConditionVariable Sleep WakeConditionVariable

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime GetTickCount64 GetTickCount

api-ms-win-core-console-l3-2-0

GetConsoleWindow

api-ms-win-core-processthreads-l1-1-0

TlsSetValue GetCurrentThreadId TlsGetValue TlsAlloc GetStartupInfoW ExitThread TlsFree GetProcessId GetCurrentProcess ExitProcess TerminateProcess SwitchToThread GetExitCodeProcess CreateThread SetThreadPriority GetCurrentThread GetExitCodeThread GetCurrentProcessId

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent GetThreadContext OpenProcess

api-ms-win-core-toolhelp-l1-1-0

CreateToolhelp32Snapshot Process32FirstW Process32NextW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-memory-l1-1-0

VirtualProtect VirtualAllocEx VirtualFreeEx MapViewOfFile ReadProcessMemory UnmapViewOfFile

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-console-l2-2-0

SetConsoleTitleA SetConsoleTitleW

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentStringsW GetCommandLineA FreeEnvironmentStringsW SetEnvironmentVariableW GetStdHandle GetCommandLineW SetStdHandle GetEnvironmentVariableA

api-ms-win-core-console-l1-1-0

WriteConsoleW AllocConsole ReadConsoleW SetConsoleMode GetConsoleMode GetConsoleOutputCP

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent OutputDebugStringA

api-ms-win-core-errorhandling-l1-1-0

GetLastError RaiseException SetUnhandledExceptionFilter SetLastError UnhandledExceptionFilter

api-ms-win-core-com-l1-1-0

CoGetObjectContext CoInitializeEx CoTaskMemFree CoGetApartmentType CoCreateFreeThreadedMarshaler

api-ms-win-core-console-l2-1-0

FillConsoleOutputCharacterA SetConsoleWindowInfo SetConsoleCursorPosition SetConsoleScreenBufferSize GetConsoleScreenBufferInfo FillConsoleOutputAttribute

api-ms-win-core-file-l1-2-2

GetVolumeInformationA AreFileApisANSI

api-ms-win-core-kernel32-legacy-l1-1-0

CreateFileMappingA GetComputerNameA

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-debug-l1-1-1

CheckRemoteDebuggerPresent

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

api-ms-win-core-file-l1-1-0

GetFileAttributesExW CreateDirectoryW FlushFileBuffers SetEndOfFile CreateFileA GetFileSizeEx SetFileInformationByHandle WriteFile GetFileType FindFirstFileExW ReadFile SetFilePointerEx CreateFileW FindNextFileW FindFirstFileW FindClose GetFileInformationByHandle

api-ms-win-core-heap-l1-1-0

HeapFree HeapSize HeapReAlloc GetProcessHeap HeapAlloc

api-ms-win-core-synch-l1-1-0

EnterCriticalSection CreateEventW LeaveCriticalSection WaitForSingleObject SetEvent WaitForSingleObjectEx InitializeCriticalSectionAndSpinCount DeleteCriticalSection InitializeCriticalSectionEx ReleaseSRWLockExclusive TryAcquireSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockShared AcquireSRWLockExclusive

kernel32

Module32First Module32Next SetProcessDEPPolicy

user32

ReleaseCapture IsWindowUnicode ReleaseDC SetCursorPos GetClientRect SetCursor GetCursorPos SetCapture MonitorFromPoint DispatchMessageA DestroyWindow SetWindowLongA DefWindowProcA CreateWindowExA TranslateMessage PeekMessageA UnregisterClassA PostQuitMessage RegisterClassExA GetForegroundWindow IsIconic GetWindowLongW GetWindowRect SetWindowPos MessageBoxA SetLayeredWindowAttributes SetWindowLongW GetWindowThreadProcessId EnumWindows GetAncestor SetWindowDisplayAffinity keybd_event IsWindow MapVirtualKeyA SetForegroundWindow IsWindowVisible ShowWindow FindWindowA MapVirtualKeyW GetAsyncKeyState SendInput OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetKeyState GetMessageExtraInfo LoadCursorA GetDC ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout UpdateWindow

gdi32

GetDeviceCaps

comdlg32

GetOpenFileNameA

shell32

ShellExecuteW SHGetFolderPathA SHGetKnownFolderPath ShellExecuteA

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

winmm

PlaySoundA

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

api-ms-win-core-threadpool-l1-2-0

TrySubmitThreadpoolCallback

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead InterlockedPushEntrySList

api-ms-win-core-fibers-l1-1-0

FlsAlloc FlsFree FlsGetValue FlsSetValue

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation

oleaut32

SysFreeString SetErrorInfo GetErrorInfo SysStringLen

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

118KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=187, id=261, version=33145,

count=60, id=260, version=33145,

count=34, id=259, version=33145,

count=1, id=253, version=35207,

count=19, id=260, version=35207,

count=14, id=259, version=35207,

count=107, id=261, version=35207,

count=1, id=262, version=33145,

count=98, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=16, id=261, version=35222,

count=4, id=259, version=35217,

count=24, id=260, version=35217,

count=2, id=156, version=21202,

count=27, id=260, version=32822,

count=27, id=257, version=33145,

count=325, id=1, productName=Unmarked objects,

count=100, id=265, version=35222,

count=1, id=259, version=35222,

count=1, id=255, version=35222,

count=1, id=258, version=35222,