HONEYVIEW-SETUP[.]EXE

Sharing

Copy URL Twitter E-mail

General

Target
HONEYVIEW-SETUP.EXE
Size 7.7MB
Sample260709-xtfbzagt5n
SHA256 831622fcffc89f5ed28a2d796eb0b4157a7d8bd8019d4faf4ef75ddc949933ab
MD5 a0eb976627db97cb203cb592a172b47a
SHA1 6f8e065cdde2aa3343d27c9f8a8e6d4225044b5f
SHA512 8b76002b647641851e0ec7f4faf0ae2059658606896ed0184337cd7beca067c2804d7daa1d7a07505f2bb404ad98e6a7bed7d96a0eee60a136f462cb87df3031
SSDEEP 196608:FI5dsTTBcqlsS2c2tS97660dBGHgG1yvzsYsJNmjV/k5u:FIzWiyZj9QbGHg+yIYSW/yu
TLSH
T108863318A409B821F2A44FBD5F876381A972E17C5D2056073B2E6BF31546883D26E7FF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

File Explorer

HONEYVIEW-SETUP.EXE

.exe 7.7MB
$PLUGINSDIR/LangDLL.dll

.dll 5KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/license.rtf

.rtf 7KB
$PLUGINSDIR/logo.ico

6KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
Honeyview.exe

.exe 9.2MB
VersionNo.ini

31B
config.ini

517B

HONEYVIEW-SETUP.EXE

IMPHASH 61259b55b8912888e90f516ca08dc514
SHA256 831622fcffc89f5ed28a2d796eb0b4157a7d8bd8019d4faf4ef75ddc949933ab
MD5 a0eb976627db97cb203cb592a172b47a
SHA1 6f8e065cdde2aa3343d27c9f8a8e6d4225044b5f
SHA512 8b76002b647641851e0ec7f4faf0ae2059658606896ed0184337cd7beca067c2804d7daa1d7a07505f2bb404ad98e6a7bed7d96a0eee60a136f462cb87df3031
SSDEEP 196608:FI5dsTTBcqlsS2c2tS97660dBGHgG1yvzsYsJNmjV/k5u:FIzWiyZj9QbGHg+yIYSW/yu
TLSH
T108863318A409B821F2A44FBD5F876381A972E17C5D2056073B2E6BF31546883D26E7FF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

90:e5:21:1e:67:47:24:29:29:21:91:e9:c7:88:44:dc:5b:73:1b:69:4e:23:68:53:07:62:bb:3f:cc:2a:23:19

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR

Chains

Jul 9, 2024

CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Digest

de:26:6c:df:91:1b:48:c2:c0:31:75:13:36:19:83:1b:0e:82:97:0d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR

Chains

Jul 9, 2024

CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR

Serial Number

45:2d:ba:a0:52:13:f6:ea:e3:56:65:03:d3:5c:05:ad

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 28, 2023 - Mar 27, 2026

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

13888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/LangDLL.dll

IMPHASH 3e8d18bb71c7ebbda2ddc2a4bb03547b
SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
MD5 68b287f4067ba013e34a1339afdb1ea8
SHA1 45ad585b3cc8e5a6af7b68f5d8269c97992130b3
SHA512 06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
SSDEEP 48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L
TLSH
T16BC19474B3C248B9C491513768AB33D36612EE746784500F9F6711AA38209F7AD3EBC3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5439

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Honeyview.exe

IMPHASH 5941a346ec1d26e436f03d004ac38b79
SHA256 d403cf6f1befdcb5e048d4dd0016a96b8018f6cbb5f8020e0174ef7d8da64a13
MD5 21d2b5677e427262d6f518c5d2889f67
SHA1 362ac1aa028efa16592bb7bfa56816885ea1cbb9
SHA512 7f227c4aa7b639d492c401595f535576569a07a3f694e125515fa8e84c935a67de3d343298e41893926a5532fc383bf22d7e91dd1c7e0f45cad6b590eec2b85f
SSDEEP 196608:lCldKomPg2EIxaxdRifeG0URCwGxUpnmMXXacwM5OJ5kCQVwAt7zYtl+2:lILSxLt7zYtA2
TLSH
T1EDA65A81F6D68295D2522C72B86FF226E73076494BECC1B3FAD01DC0A8743917DB71A6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

7a:39:fc:67:33:33:be:1b:30:d8:45:c0:32:6e:37:d2:c2:c7:35:21:17:6c:f5:c4:1e:34:14:9f:9d:f9:80:5b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR

Chains

Jun 20, 2024

CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Digest

df:73:d4:93:e5:48:e9:55:cf:b5:00:26:35:72:b7:af:ab:12:9d:dc

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR

Chains

Jun 20, 2024

CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR

Serial Number

45:2d:ba:a0:52:13:f6:ea:e3:56:65:03:d3:5c:05:ad

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 28, 2023 - Mar 27, 2026

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

2408870

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\devel\HV5\bin\Honeyview32.pdb

kernel32

IsProcessorFeaturePresent GetTempFileNameW GetTempPathW DeleteFileA GetTimeZoneInformation TlsGetValue GetSystemTimeAsFileTime TlsSetValue CreateSemaphoreW TlsAlloc TlsFree CompareStringW GetACP QueryPerformanceCounter QueryPerformanceFrequency VirtualFree GetFullPathNameW CreateProcessW CreateDirectoryW GetCurrentThread GetSystemDirectoryW lstrcpynW GetFileAttributesW TerminateProcess IsDBCSLeadByteEx RemoveDirectoryW GetCurrentProcessId LocalFree lstrcpyW LocalAlloc FileTimeToLocalFileTime ResetEvent GetWindowsDirectoryW SetThreadPriority CopyFileW MoveFileW CreateThread ReadDirectoryChangesW GetExitCodeThread HeapFree GetProcessHeap HeapAlloc LoadLibraryA VirtualAlloc HeapDestroy HeapReAlloc HeapSize RtlUnwind UnhandledExceptionFilter IsDebuggerPresent ExitThread GetStartupInfoW LCMapStringA LCMapStringW GetCPInfo GetOEMCP IsValidCodePage HeapCreate WaitForSingleObject GetStdHandle GetModuleFileNameA CreateFileA FlushFileBuffers ExitProcess SetUnhandledExceptionFilter DeleteFileW SetFileAttributesW InitializeCriticalSectionAndSpinCount GetTimeFormatA GetDateFormatA GetUserDefaultLCID WideCharToMultiByte ReadFile GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW GetConsoleCP GetConsoleMode SetHandleCount GetFileType GetStartupInfoA SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetLocaleInfoW WriteConsoleA GetConsoleOutputCP WriteConsoleW GetModuleHandleA CompareStringA SetEnvironmentVariableA WriteFile SetFilePointer GetFileSize FindNextFileW FindClose FindFirstFileW SetCurrentDirectoryW FileTimeToSystemTime GetTickCount SystemTimeToTzSpecificLocalTime lstrlenA ExpandEnvironmentStringsW lstrcpyA GetFileTime GlobalMemoryStatusEx GetLongPathNameW GetFileSizeEx CreateFileW Sleep LoadLibraryW CloseHandle GetCurrentThreadId DeleteCriticalSection OpenFileMappingW SetEndOfFile SleepConditionVariableCS WaitForSingleObjectEx InitializeConditionVariable InitializeCriticalSectionEx WakeConditionVariable lstrcmpiW GetSystemInfo GlobalHandle CreateEventW LockResource GlobalFree EnterCriticalSection GetProcAddress SetLastError GetLastError InterlockedExchange RaiseException FlushInstructionCache InterlockedCompareExchange GlobalUnlock lstrlenW MultiByteToWideChar lstrcmpW GetModuleFileNameW MulDiv LeaveCriticalSection SizeofResource GlobalAlloc InitializeCriticalSection GetModuleHandleW SetEvent GlobalLock GetCurrentProcess InterlockedDecrement InterlockedIncrement LoadLibraryExW LoadResource FreeLibrary FindResourceW SetErrorMode FindResourceExW UnmapViewOfFile MapViewOfFile SleepEx CreateMutexW

user32

SetScrollRange InflateRect SetScrollPos SetScrollInfo EqualRect IsWindowVisible DrawTextW IntersectRect UnionRect PeekMessageW SetWindowPlacement ShowCursor GetForegroundWindow GetWindowPlacement OffsetRect TrackPopupMenu GetSubMenu GetMenuStringW LoadMenuW AppendMenuW EnableMenuItem RemoveMenu DestroyMenu CheckMenuItem CloseClipboard CreateDialogIndirectParamW EmptyClipboard OpenClipboard SetClipboardData SetWindowRgn SetTimer GetWindowRect PostQuitMessage GetWindowDC GetKeyState SetForegroundWindow DialogBoxParamW SubtractRect SetRectEmpty PtInRect SetRect EndDialog ShowWindow FindWindowExW EnableWindow CopyRect IsRectEmpty GetPropW MapWindowPoints RegisterClassW TrackPopupMenuEx SetPropW CallNextHookEx TrackMouseEvent RemovePropW IsWindowEnabled MonitorFromRect GetWindowThreadProcessId GetMonitorInfoW BringWindowToTop IsDialogMessageW AttachThreadInput MonitorFromPoint UnhookWindowsHookEx SetWindowsHookExW GetScrollInfo ScrollWindow ShowScrollBar GetDlgItemInt SetDlgItemInt SendDlgItemMessageW InsertMenuW GetDlgItemTextW SetDlgItemTextW PostMessageW LoadIconW SetCursorPos SystemParametersInfoW GetCursorPos GetSystemMetrics EndPaint ClientToScreen DestroyWindow GetWindowTextLengthW TranslateAcceleratorW DestroyAcceleratorTable ScreenToClient GetMessageW CharNextW RegisterWindowMessageW FillRect IsChild SetCapture DialogBoxIndirectParamW MapDialogRect SetWindowContextHelpId MonitorFromWindow wsprintfW CharNextExA CreatePopupMenu GetMenuItemID GetMenuItemInfoW ModifyMenuW EnumChildWindows GetMenuItemCount DrawIcon GetCapture GetClassLongW GetCaretPos GetDlgCtrlID EnumDisplayMonitors EnumWindows KillTimer GetFocus GetParent InvalidateRgn LoadCursorW FindWindowW GetClientRect CreateAcceleratorTableW SetFocus BeginPaint GetClassInfoExW GetDC TranslateMessage LoadAcceleratorsW RegisterClassExW InvalidateRect GetWindowLongW GetWindowTextW GetClassNameW ReleaseDC GetDlgItem SetWindowLongW RedrawWindow GetDesktopWindow GetSysColor SetWindowPos GetActiveWindow IsWindow CreateWindowExW MessageBoxW ReleaseCapture SendMessageW SetWindowTextW CallWindowProcW DefWindowProcW GetWindow MoveWindow DispatchMessageW SetCursor UnregisterClassA

gdi32

GetTextExtentPoint32W OffsetWindowOrgEx EndDoc ExtTextOutW CreateDCW StartPage EndPage SetPixel SetBkColor ExtCreateRegion MoveToEx LineTo CombineRgn OffsetRgn SetWindowOrgEx GetTextMetricsW ExcludeClipRect SetTextColor CreateFontIndirectW SetBkMode CreateFontW GetICMProfileW CreateDIBSection CreateRectRgn BitBlt DeleteDC GetDeviceCaps DeleteObject SelectObject CreateCompatibleDC CreateCompatibleBitmap GetObjectW StartDocW CreateSolidBrush GetStockObject

winspool.drv

EnumPrintersW DocumentPropertiesW OpenPrinterW ord203 ClosePrinter

comdlg32

GetOpenFileNameW GetSaveFileNameW ChooseColorW

advapi32

RegQueryInfoKeyW RegDeleteKeyW IsTextUnicode FreeSid SetEntriesInAclW AllocateAndInitializeSid SetNamedSecurityInfoW RegQueryValueExW RegDeleteValueW RegSetValueExA RegSetValueExW RegCloseKey RegEnumKeyExW RegOpenKeyExW RegCreateKeyExW

shell32

DragAcceptFiles SHAppBarMessage ord68 SHGetFolderPathW DragQueryFileW DragFinish SHGetSpecialFolderPathW SHGetFolderLocation ord2 SHGetDataFromIDListW ord16 ord4 ord21 SHCreateDirectoryExW SHGetMalloc SHGetFileInfoW SHGetSpecialFolderLocation SHGetDesktopFolder SHChangeNotify SHFileOperationW ord155 SHGetPathFromIDListW SHOpenFolderAndSelectItems SHBrowseForFolderW ord190 ShellExecuteW

ole32

CoTaskMemAlloc CoGetClassObject CoTaskMemFree OleUninitialize OleInitialize StringFromGUID2 CreateStreamOnHGlobal CLSIDFromString CLSIDFromProgID CoTaskMemRealloc CoUninitialize OleLockRunning CoCreateInstance OleSetContainedObject OleCreate CoAllowSetForegroundWindow CoInitialize

oleaut32

SysStringLen VariantClear LoadTypeLi VariantInit SysAllocStringLen SysAllocString LoadRegTypeLi SysFreeString VarUI4FromStr OleCreateFontIndirect

shlwapi

PathCanonicalizeW StrFormatByteSizeW PathIsRelativeW StrStrW PathIsDirectoryW

comctl32

_TrackMouseEvent

winmm

timeBeginPeriod PlaySoundW timeEndPeriod

imm32

ImmAssociateContext

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

crypt32

CertGetNameStringW

wintrust

WTHelperGetProvCertFromChain WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData WinVerifyTrust

wininet

HttpQueryInfoW HttpAddRequestHeadersW InternetSetOptionW HttpSendRequestW InternetReadFile HttpOpenRequestA InternetQueryDataAvailable InternetQueryOptionW InternetConnectA InternetOpenW InternetCloseHandle InternetErrorDlg InternetCrackUrlA

Name

.text

Size

7.1MB

Virtual Size

7.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

IPPCODE

Size

773KB

Virtual Size

773KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

935KB

Virtual Size

934KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

139KB

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ve_share

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

100KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

173KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

HONEYVIEW-SETUP.EXE

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/license.rtf

$PLUGINSDIR/logo.ico

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Honeyview.exe

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

winmm

imm32

version

crypt32

wintrust

wininet

generic

VersionNo.ini

config.ini