Sheldon[.]7z | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Sheldon.7z
Size 10.1MB
Sample260710-nfkvvsbs8x
SHA256 6c536d1bc93eb79c2a0d82d733ea29db0ea63ddfcd8b28c581585c791bd1aa6a
MD5 80d17d9a5186ee24302129eb24469b53
SHA1 954228dd159e6d343e8f970e76000bfe4bb10341
SHA512 2f8266a2e1e457b85ce9a961d1143b0dbefdffc21d929163bcc600940fff4f3b4dcf485fd70e0255c9f2dbeb0334bcbb2263524caa69c9db2c560295689f1180
SSDEEP 196608:uwEs5yRdVkIr90CLkOrwr/RvQovW/S7yKG+GmvNsjwmnHndciRBefhGaccKSolxJ:wM4FryCoOMDpQovLGIvmnSiRBmwacnxJ
TLSH
T15EB633FB91C93BFDFA653CF439D99D51E4D32D784C2918C396683BE8282ADB06392414
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Sheldon.exe

File Explorer

Sheldon.7z

.7z 10.1MB
Sheldon.exe

.exe 11.5MB

Sheldon.7z

SHA256 6c536d1bc93eb79c2a0d82d733ea29db0ea63ddfcd8b28c581585c791bd1aa6a
MD5 80d17d9a5186ee24302129eb24469b53
SHA1 954228dd159e6d343e8f970e76000bfe4bb10341
SHA512 2f8266a2e1e457b85ce9a961d1143b0dbefdffc21d929163bcc600940fff4f3b4dcf485fd70e0255c9f2dbeb0334bcbb2263524caa69c9db2c560295689f1180
SSDEEP 196608:uwEs5yRdVkIr90CLkOrwr/RvQovW/S7yKG+GmvNsjwmnHndciRBefhGaccKSolxJ:wM4FryCoOMDpQovLGIvmnSiRBmwacnxJ
TLSH
T15EB633FB91C93BFDFA653CF439D99D51E4D32D784C2918C396683BE8282ADB06392414
MD5 SHA1 SHA512 SSDEEP TLSH

Password

alr

Sheldon.exe

IMPHASH 03a4ab31ee9d157e7957ec7869b014e6
SHA256 6ed60f576153130468820909518d4dbb61d2f008b2a8540746efce6b601a6358
MD5 5782d2dce1da8210b643fd950a605a2c
SHA1 ab7143f442e0958936f6fa52c8d34c403265f34e
SHA512 e44f02571bdff0e9760f55c598d5089fafd8ba64376ede84617357fc0b8d00d9c3d91d65d63174ac0705610b16620aacecb7e0ac60bf970130e20e3a57d1be31
SSDEEP 196608:cD6eqLlHPcj6eMJL0T7pXNS0OIo7thwuTWUQ/hQL9x1IQzTIJk6zWebt1+zyY:tBPBLQNXodn7th4/W5xIJiebyt
TLSH
T17EC623D795DD76B9D0412A728583538787C0A0B6CDA656C833FC1C0DEEA7D8142CABBE
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

alr

Minor OS version

Major OS version

Entry point

21375125

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\Programming\Github\mine\Sheldon\Sheldon\build\Sheldon\Sheldon.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dxgi

CreateDXGIFactory

winmm

timeBeginPeriod timeEndPeriod

dbghelp

SymGetOptions SymSetOptions SymFunctionTableAccess64 UnDecorateSymbolName StackWalk64 SymCleanup SymGetLineFromAddr64 SymFromAddr SymGetModuleBase64 SymInitialize

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey RegCreateKeyExW RegSetValueExW CryptReleaseContext CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptAcquireContextW

api-ms-win-core-file-l1-1-0

SetFilePointerEx ReadFile WriteFile GetDriveTypeW FlushFileBuffers DeleteFileW CreateFileW SetEndOfFile

api-ms-win-core-namedpipe-l1-1-0

CreatePipe WaitNamedPipeW PeekNamedPipe

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle DuplicateHandle

api-ms-win-core-processthreads-l1-1-0

TlsFree TlsAlloc SuspendThread ExitThread TlsSetValue GetCurrentProcessId ExitProcess CreateProcessW ResumeThread TerminateProcess GetCurrentThreadId GetExitCodeProcess TlsGetValue GetCurrentProcess GetCurrentThread OpenThread

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExA GetModuleFileNameA LoadLibraryExA GetProcAddress GetModuleFileNameW LoadLibraryExW FreeLibrary FreeLibraryAndExitThread GetModuleHandleA GetModuleHandleW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte CompareStringW MultiByteToWideChar

api-ms-win-core-localization-l1-2-0

IsValidCodePage IsDBCSLeadByte LCMapStringW GetLocaleInfoW GetACP GetOEMCP IsValidLocale FormatMessageA GetUserDefaultLCID EnumSystemLocalesW GetLocaleInfoA

api-ms-win-core-sysinfo-l1-1-0

GetSystemTime GetTickCount64 GlobalMemoryStatusEx GetSystemInfo GetSystemDirectoryA GetSystemTimeAsFileTime

api-ms-win-core-memory-l1-1-0

VirtualFreeEx WriteProcessMemory VirtualProtectEx VirtualAllocEx VirtualAlloc VirtualQuery VirtualProtect VirtualQueryEx VirtualFree

api-ms-win-core-psapi-ansi-l1-1-0

K32GetModuleFileNameExA K32GetModuleBaseNameA

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics GetMonitorInfoW

api-ms-win-core-processthreads-l1-1-1

FlushInstructionCache SetThreadContext GetThreadTimes GetThreadContext IsProcessorFeaturePresent OpenProcess

api-ms-win-core-errorhandling-l1-1-1

AddVectoredExceptionHandler

api-ms-win-core-console-l2-2-0

SetConsoleTitleA

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineA GetCommandLineW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentVariableW SetEnvironmentVariableW SetStdHandle GetEnvironmentStringsW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW OutputDebugStringA IsDebuggerPresent

api-ms-win-core-synch-l1-2-0

Sleep WakeByAddressSingle WakeByAddressAll WaitOnAddress

api-ms-win-core-synch-l1-1-0

CreateEventW WaitForSingleObject InitializeSRWLock

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock GlobalLock

api-ms-win-core-heap-l2-1-0

GlobalAlloc GlobalFree

api-ms-win-core-console-l3-2-0

GetConsoleWindow

api-ms-win-core-toolhelp-l1-1-0

Thread32Next Thread32First Process32FirstW CreateToolhelp32Snapshot Process32NextW

api-ms-win-core-psapi-l1-1-0

K32GetModuleInformation QueryFullProcessImageNameW

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter QueryPerformanceFrequency

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW LoadLibraryA

api-ms-win-core-console-l1-1-0

ReadConsoleA GetConsoleOutputCP ReadConsoleW GetConsoleMode WriteConsoleW SetConsoleCtrlHandler SetConsoleMode

api-ms-win-core-heap-l1-1-0

HeapCreate HeapSize HeapReAlloc HeapAlloc HeapFree

crypt32

CertFreeCertificateChain CryptQueryObject CertFreeCertificateChainEngine CertCreateCertificateChainEngine CertFindExtension CertFreeCTLContext CertAddCertificateContextToStore CertFreeCRLContext CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertEnumCertificatesInStore CertOpenStore CertCloseStore CertOpenSystemStoreW CertDuplicateCertificateContext CertFindCertificateInStore CertGetCertificateContextProperty CertGetCertificateChain CertGetNameStringW CertFreeCertificateContext

wintrust

CryptCATCatalogInfoFromContext CryptCATAdminAcquireContext CryptCATAdminEnumCatalogFromHash WinVerifyTrust CryptCATAdminCalcHashFromFileHandle CryptCATAdminReleaseCatalogContext

user32

PostQuitMessage RegisterClassA DefWindowProcW GetRawInputData ShowWindow RegisterRawInputDevices GetMessageW TranslateMessage DispatchMessageW CreateWindowExA GetAsyncKeyState MapVirtualKeyA SendInput VkKeyScanA mouse_event MessageBeep OpenClipboard GetClipboardData CloseClipboard EmptyClipboard SetClipboardData MonitorFromWindow EnumDisplaySettingsW GetCursorPos GetClientRect GetForegroundWindow SetWindowPos SetWinEventHook RegisterClassExW CreateWindowExW UnregisterClassW SetLayeredWindowAttributes UpdateWindow SetForegroundWindow SetFocus GetWindowLongW PeekMessageW SetWindowLongW SetWindowDisplayAffinity DestroyWindow ScreenToClient AttachThreadInput keybd_event MapVirtualKeyW GetWindowThreadProcessId GetKeyNameTextA GetDC ReleaseDC GetKeyboardLayout TrackMouseEvent GetMessageExtraInfo GetKeyState GetCapture SetCapture ReleaseCapture IsWindowUnicode SetCursorPos SetCursor LoadCursorW FindWindowA EnumWindows ClientToScreen GetUserObjectInformationW MessageBoxW GetProcessWindowStation

kernel32

DecodePointer EncodePointer GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns GetCPInfo RaiseException RtlPcToFileHeader InitOnceComplete InitOnceBeginInitialize GetLocaleInfoEx GetFileInformationByHandleEx AreFileApisANSI CreateFile2 GetTempPathW SetFileInformationByHandle GetStringTypeW SetUnhandledExceptionFilter FindNextFileW LCMapStringEx FindFirstFileW FindClose CreateDirectoryW GetCurrentDirectoryW GetExitCodeThread SwitchToThread SleepConditionVariableSRW AcquireSRWLockShared TryAcquireSRWLockExclusive GetSystemTimePreciseAsFileTime WakeAllConditionVariable WakeConditionVariable InitializeCriticalSection SetThreadPriority CreateSemaphoreW CreateEventA ReleaseSemaphore ResetEvent SetEvent GetFileInformationByHandle FormatMessageW LocalFree CreateThread WaitForSingleObjectEx WaitForMultipleObjects GetStartupInfoW InitializeSListHead FindFirstFileExW CompareStringEx GetFileType GetFileAttributesExW GetStdHandle VerifyVersionInfoW SetLastError GetEnvironmentVariableA GetTickCount DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection SleepEx MoveFileExW GetFullPathNameW AcquireSRWLockExclusive ReleaseSRWLockExclusive CreateFileMappingA UnmapViewOfFile MapViewOfFile GetProcessHeap GetFileSizeEx CreateFileA Module32NextW Module32FirstW K32EnumProcessModules ReleaseSRWLockShared GetSystemTimeAsFileTime CreateEventA GetModuleHandleA TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep LoadLibraryA FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree HeapAlloc HeapFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection MultiByteToWideChar GetModuleHandleW LoadResource FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers FlsSetValue GetCommandLineA GetCPInfo GetACP GetOEMCP IsValidCodePage EncodePointer DecodePointer FlsGetValue FlsFree SetLastError FlsAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RaiseException RtlPcToFileHeader RtlUnwindEx LCMapStringA LCMapStringW SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapSetInformation HeapCreate HeapDestroy QueryPerformanceCounter GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize WriteFile SetFilePointer GetConsoleCP GetConsoleMode HeapReAlloc InitializeCriticalSectionAndSpinCount SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA

shell32

ShellExecuteA ShellExecuteW ShellExecuteExA

imm32

ImmSetCandidateWindow ImmReleaseContext ImmSetCompositionWindow ImmGetContext

gdi32

GetPixel

dwmapi

DwmExtendFrameIntoClientArea

bcrypt

BCryptGenRandom

ws2_32

getpeername connect bind shutdown closesocket inet_ntoa gethostbyaddr getservbyport getservbyname getsockname getsockopt recv inet_addr htons send accept WSAGetLastError socket gethostbyname setsockopt gethostname WSASetLastError WSAIoctl htonl listen sendto WSACloseEvent recvfrom WSACreateEvent ioctlsocket freeaddrinfo getaddrinfo select __WSAFDIsSet WSACleanup WSAEnumNetworkEvents WSAEventSelect WSAStartup ntohs WSAWaitForMultipleEvents WSAResetEvent

secur32

InitSecurityInterfaceW

iphlpapi

if_nametoindex

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind RtlUnwind RtlUnwindEx

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList

api-ms-win-core-fibers-l1-1-0

FlsSetValue FlsFree FlsAlloc FlsGetValue

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime GetTimeZoneInformation FileTimeToSystemTime SystemTimeToTzSpecificLocalTime

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW GetDateFormatW

api-ms-win-eventlog-legacy-l1-1-0

ReportEventW DeregisterEventSource RegisterEventSourceW

api-ms-win-security-cryptoapi-l1-1-0

CryptGenRandom CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptSignHashW CryptExportKey CryptDecrypt CryptEnumProvidersW

api-ms-win-core-synch-ansi-l1-1-0

CreateSemaphoreA

oleaut32

SetErrorInfo SysStringLen GetErrorInfo SysFreeString

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-com-l1-1-0

CoTaskMemFree CoCreateFreeThreadedMarshaler CoUninitialize CoInitializeEx

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

Virtual Size

9.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

353KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.sheldon

Size

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.sheldon

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.sheldon

Size

11.5MB

Virtual Size

11.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

469B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Sheldon.7z

Sheldon.exe

d3d11

d3dcompiler_47

dxgi

winmm

dbghelp

advapi32

api-ms-win-core-file-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-psapi-ansi-l1-1-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-console-l2-2-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-console-l3-2-0

api-ms-win-core-toolhelp-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-console-l1-1-0

api-ms-win-core-heap-l1-1-0

crypt32

wintrust

user32

kernel32

shell32

imm32

gdi32

dwmapi

bcrypt

ws2_32

secur32

iphlpapi

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-eventlog-legacy-l1-1-0

api-ms-win-security-cryptoapi-l1-1-0

api-ms-win-core-synch-ansi-l1-1-0

oleaut32

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-com-l1-1-0

api-ms-win-core-winrt-l1-1-0

generic