Solstice 26[.]34[.]rar

Sharing

Copy URL Twitter E-mail

General

Target
Solstice 26.34.rar
Size 7.8MB
Sample260803-vyly7sch29
SHA256 90c32243e3f2aa12f08b7dff961af9bb1615e2ea629468f489225d23a24f5fd0
MD5 0ba275a91b91a73fe659c9fa4f83406c
SHA1 35235deb31662ec6e7ce27cc4026a4e16af5dc58
SHA512 0153522f21e79e7e054ef8cd28614ce4d04a25a56d00c62a579a8f0b71dcfbea6fbc12198742e9fea677badac79e1a98a45dcd636049f9628d153bed6f27cd9e
SSDEEP 196608:LM9WZkpBczP8cadj0vaNQf3AGRwxeRM2rJsrw:BZkp+7Adj0va8KxQMgOM
TLSH
T1EF8633CA8C606CA8CF8FC97574036E8FDC5C247A838B654EE36B0D1D2E69E965C1113B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Solstice 26.34/FateInjector.exe
unpack001/Solstice 26.34/Solstice 26.3X.dll

File Explorer

Solstice 26.34.rar

.rar 7.8MB
Solstice 26.34/FateInjector.exe

.exe 3.7MB
Solstice 26.34/Solstice 26.3X.dll

.dll 18.6MB

Solstice 26.34.rar

SHA256 90c32243e3f2aa12f08b7dff961af9bb1615e2ea629468f489225d23a24f5fd0
MD5 0ba275a91b91a73fe659c9fa4f83406c
SHA1 35235deb31662ec6e7ce27cc4026a4e16af5dc58
SHA512 0153522f21e79e7e054ef8cd28614ce4d04a25a56d00c62a579a8f0b71dcfbea6fbc12198742e9fea677badac79e1a98a45dcd636049f9628d153bed6f27cd9e
SSDEEP 196608:LM9WZkpBczP8cadj0vaNQf3AGRwxeRM2rJsrw:BZkp+7Adj0va8KxQMgOM
TLSH
T1EF8633CA8C606CA8CF8FC97574036E8FDC5C247A838B654EE36B0D1D2E69E965C1113B
MD5 SHA1 SHA512 SSDEEP TLSH

Solstice 26.34/FateInjector.exe

IMPHASH 7872442659d25a99d4c81847d3fcd592
SHA256 77a84c4ed29551d8968a9bc5de796d6f8463fa54df8554b3cff91ca83d8ff70d
MD5 9e6de7c7ebd1a00c2f7ddec78ba9403a
SHA1 65a9e65bf9b2b683ed93ac9848df8b5c9f3d4297
SHA512 f2dac6efaf4fa6c32b14a45bfa60813b67eb3a46e9a7342d13c1ba3bea3e0a188a5703d34c5fc65d20baae751c334474a9b51d7862d4c74fb60007dd8ce4adc9
SSDEEP 49152:PVE0okol7ESpUbVIwI2SovAJsXbkiokMTU+tbCn8GTs5QnSaTevSpoadQ4zXgpdP:dEcI71ibyJJkwC9JfdQ4zitt
TLSH
T178066C5A66F902ECD5BAC17C8D6B8902E3B338574B7253DF0990555E4F27BE48E3A320
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2342428

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Fligger\Source\Repos\FateInjector\x64\Release\FateInjector.pdb

kernel32

QueryPerformanceFrequency GetDriveTypeW LoadLibraryW CreateRemoteThread WriteProcessMemory VirtualAllocEx OpenProcess CloseHandle Process32NextW Process32FirstW CreateToolhelp32Snapshot LocalFree Sleep InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry WaitForSingleObjectEx ResetEvent InitializeCriticalSectionAndSpinCount GlobalSize GetProcessHeap HeapSize GlobalFree GlobalLock GlobalUnlock GlobalAlloc SetLastError MulDiv ReadConsoleOutputCharacterA SetConsoleCursorPosition GetConsoleScreenBufferInfo FillConsoleOutputCharacterW WriteConsoleW WriteConsoleA AttachConsole FreeConsole GetStdHandle ExpandEnvironmentStringsW GetSystemTimeAsFileTime IsBadStringPtrA IsBadReadPtr CopyFileW GetFileType SetCurrentDirectoryW GetProcAddress GetModuleHandleW FreeLibrary WaitForMultipleObjects CreateEventW SetEvent GetCommandLineW GetUserDefaultLCID GetLocaleInfoW GetACP GetCurrentThread RtlCaptureContext GetTempPathW GetTempFileNameW GetLongPathNameW GetFileAttributesW FindFirstFileW FindClose CreateFileW GetCPInfo IsValidCodePage FindResourceW SizeofResource LockResource LoadResource GetModuleFileNameW GetVersionExW TerminateProcess GetCurrentProcessId IsDebuggerPresent GetEnvironmentVariableW TlsFree TlsSetValue TlsAlloc GetCurrentThreadId ExitProcess GetCurrentProcess WaitForSingleObject DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection OutputDebugStringW WideCharToMultiByte MultiByteToWideChar FormatMessageW GetLastError SetErrorMode GetLogicalDriveStringsW

advapi32

RegDeleteValueW RegEnumKeyW RegEnumValueW RegOpenKeyExW RegQueryValueExW GetUserNameW RegCloseKey RegCreateKeyExW GetNamedSecurityInfoW ConvertStringSidToSidW SetEntriesInAclW SetNamedSecurityInfoW RegDeleteKeyW RegSetValueExW

comctl32

ImageList_Create ImageList_Destroy ImageList_GetImageCount ImageList_Add ImageList_SetBkColor ImageList_Draw ImageList_Replace ord17 ImageList_GetIconSize ImageList_GetImageInfo ord16

rpcrt4

UuidToStringW RpcStringFreeW

uxtheme

IsAppThemed GetThemeFont GetThemeColor IsThemeActive GetThemeSysFont GetThemeSysColor GetThemeInt GetThemePartSize GetThemeMargins DrawThemeParentBackground IsThemeBackgroundPartiallyTransparent GetThemeBackgroundContentRect DrawThemeBackground CloseThemeData IsThemePartDefined OpenThemeData GetThemeBackgroundExtent GetCurrentThemeName SetWindowTheme

msvcp140

?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAJ@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?uncaught_exception@std@@YA_NXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Xlength_error@std@@YAXPEBD@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??7ios_base@std@@QEBA_NXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?_Throw_C_error@std@@YAXH@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Xout_of_range@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??Bid@locale@std@@QEAA_KXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A _Cnd_do_broadcast_at_thread_exit ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ _Thrd_detach ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z

msimg32

AlphaBlend GradientFill

shlwapi

SHAutoComplete

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp longjmp __current_exception wcschr __intrinsic_setjmp __std_terminate _purecall strstr __C_specific_handler _set_se_translator strchr wcsstr memset memmove memcpy _CxxThrowException __std_exception_copy __std_type_info_compare __RTtypeid __std_exception_destroy __current_exception_context

api-ms-win-crt-stdio-l1-1-0

__p__commode fflush setvbuf fsetpos _set_fmode __stdio_common_vswscanf _fseeki64 fgetpos fwrite __stdio_common_vfprintf _open_osfhandle fread fgetc ungetc fputc _ftelli64 ferror feof clearerr _wfopen _telli64 _lseeki64 _write _read _close _wsopen_dispatch _get_osfhandle _fileno __stdio_common_vfwprintf __stdio_common_vswprintf_p __stdio_common_vswprintf __acrt_iob_func _get_stream_buffer_pointers fclose __stdio_common_vsprintf fputwc ungetwc fgetwc _getcwd __stdio_common_vsscanf

api-ms-win-crt-runtime-l1-1-0

_initterm_e _initterm _get_narrow_winmain_command_line _register_thread_local_exe_atexit_callback _set_app_type _seh_filter_exe _cexit _exit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv exit _invalid_parameter_noinfo_noreturn _crt_atexit abort _errno _c_exit terminate _beginthreadex

api-ms-win-crt-heap-l1-1-0

calloc _set_new_mode realloc _callnewh malloc free

api-ms-win-crt-convert-l1-1-0

_wtoi wcstol atoi wcstoul _wtol atof _wcstod_l wcstod _wcstoui64 _wcstoi64

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _wremove _wrename _lock_file

api-ms-win-crt-string-l1-1-0

_stricmp wcspbrk iswalnum _wcsicmp _strdup wcsncpy strcmp strncmp toupper iswxdigit iswprint iswalpha towupper isspace tolower iswdigit iswspace towlower

api-ms-win-crt-time-l1-1-0

wcsftime _mktime64 _get_timezone _time64 _gmtime64 _localtime64 _tzset

api-ms-win-crt-utility-l1-1-0

bsearch qsort

api-ms-win-crt-locale-l1-1-0

setlocale _configthreadlocale _create_locale _free_locale

api-ms-win-crt-environment-l1-1-0

getenv _wgetcwd _wgetenv

api-ms-win-crt-math-l1-1-0

floor fmod _fdopen sqrt pow ceilf sin atan2 __setusermatherr floorf cos

user32

ValidateRgn DestroyCursor GetCaretBlinkTime GetDoubleClickTime TranslateAcceleratorW DestroyAcceleratorTable CreateAcceleratorTableW DrawIconEx ValidateRect GetMessageW GetClassNameW MessageBeep GetWindowTextW CheckMenuRadioItem SetRect GetSysColorBrush GetMenuItemID CheckMenuItem DrawFrameControl DrawEdge SetMenuItemInfoW IsRectEmpty SetMenuInfo RemoveMenu EnumDisplayMonitors AppendMenuW GetWindowDC GetSubMenu DestroyMenu CreatePopupMenu CreateMenu GetMenuState HideCaret GetWindowTextLengthW keybd_event IsMenu CreateIconIndirect OffsetRect CopyRect SetRectEmpty DrawFocusRect DrawStateW DrawTextW GetIconInfo InsertMenuItemW wsprintfW BeginPaint LoadImageW LoadIconW LoadBitmapW DestroyIcon EndPaint UnionRect GetDesktopWindow GetComboBoxInfo ChildWindowFromPoint FindWindowExW RegisterClipboardFormatW GetClipboardFormatNameW ChangeDisplaySettingsExW EnumDisplaySettingsW MonitorFromPoint MonitorFromWindow InsertMenuW GetMonitorInfoW ModifyMenuW IsClipboardFormatAvailable MessageBoxW PostThreadMessageW PostMessageW RegisterClassW CreateWindowExW BringWindowToTop PeekMessageW SendMessageW DefWindowProcW UnregisterClassW DestroyWindow DispatchMessageW MsgWaitForMultipleObjects SetTimer KillTimer SetCursor LoadCursorW DdeInitializeW DdeUninitialize DdeConnect DdeDisconnect DdePostAdvise DdeNameService DdeClientTransaction DdeCreateDataHandle DdeGetData DdeFreeDataHandle DdeGetLastError DdeCreateStringHandleW DdeQueryStringW DdeFreeStringHandle GetKeyState GetProcessDefaultLayout RegisterWindowMessageW SetMenu GetWindowRect GetWindowPlacement ShowWindow SetLayeredWindowAttributes FlashWindowEx MoveWindow SetWindowPos IsIconic IsZoomed CreateDialogIndirectParamW GetDialogBaseUnits DrawMenuBar GetSystemMenu EnableMenuItem SetForegroundWindow SetWindowTextW SetWindowLongW GetWindowLongPtrW SetWindowLongPtrW SetWindowRgn TranslateMessage RegisterHotKey UnregisterHotKey GetMessagePos GetMessageTime PostQuitMessage CallWindowProcW IsWindow AnimateWindow BeginDeferWindowPos DeferWindowPos EndDeferWindowPos IsWindowVisible SetFocus GetActiveWindow GetFocus GetAsyncKeyState VkKeyScanW MapVirtualKeyW GetCapture SetCapture ReleaseCapture EnableWindow IsWindowEnabled GetSystemMetrics GetMenuItemCount TrackPopupMenu GetMenuItemInfoW UpdateWindow GetDC ReleaseDC GetUpdateRgn InvalidateRect RedrawWindow ScrollWindow EnableScrollBar GetClientRect SetCursorPos GetCursorPos ClientToScreen ScreenToClient MapWindowPoints WindowFromPoint ChildWindowFromPointEx GetSysColor FillRect InflateRect PtInRect GetWindowLongW GetParent SetParent GetWindow SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx IsDialogMessageW SetScrollInfo GetScrollInfo SystemParametersInfoW CreateDialogParamW GetDlgItem

gdi32

GdiFlush SetBrushOrgEx GetTextMetricsW SelectPalette SelectObject RealizePalette CreateFontIndirectW GetDeviceCaps ExcludeClipRect CreateRectRgn OffsetRgn GetRegionData CreateRectRgnIndirect DeleteObject GetSystemPaletteEntries EndPage StartPage EndDoc StartDocW SetAbortProc EnumFontFamiliesExW PlayEnhMetaFile GetEnhMetaFileHeader GetEnhMetaFileW DeleteEnhMetaFile CreateEnhMetaFileW CloseEnhMetaFile CreateDCW GetDIBColorTable CreateDIBSection GetDIBits CreateDIBitmap CreateICW GetTextExtentExPointW GetCharABCWidthsW ExtCreateRegion CreatePatternBrush CreateHatchBrush GetPaletteEntries GetNearestPaletteIndex CreatePalette RectInRegion PtInRegion GetRgnBox EqualRgn CombineRgn ExtCreatePen CreatePen SetWindowOrgEx SetWindowExtEx SetViewportOrgEx SetViewportExtEx PolyBezier Polyline Polygon ModifyWorldTransform SetWorldTransform GetWorldTransform SetStretchBltMode SetROP2 StretchDIBits StretchBlt SetPolyFillMode SetPixel GetLayout SetLayout SetMapMode SetGraphicsMode ExtSelectClipRgn SelectClipRgn RoundRect Rectangle PolyPolygon Pie MaskBlt GetStockObject GetPixel GetObjectType GetClipBox ExtFloodFill Ellipse Arc ExtTextOutW MoveToEx LineTo GetBkColor GetTextExtentPoint32W DeleteDC CreateCompatibleDC CreateCompatibleBitmap CreateBitmapIndirect CreateBitmap BitBlt SetTextColor SetBkMode SetBkColor GetWindowExtEx GetViewportExtEx GetGraphicsMode CreateSolidBrush GetObjectW GetOutlineTextMetricsW

winspool.drv

OpenPrinterW ClosePrinter DocumentPropertiesW

comdlg32

PrintDlgW ChooseFontW CommDlgExtendedError GetSaveFileNameW PageSetupDlgW GetOpenFileNameW

shell32

SHGetFileInfoW Shell_NotifyIconW ExtractIconExW ExtractIconW DragAcceptFiles DragFinish DragQueryPoint DragQueryFileW SHGetFolderPathW CommandLineToArgvW ord6

ole32

ReleaseStgMedium OleGetClipboard OleFlushClipboard OleIsCurrentClipboard CoCreateInstance RegisterDragDrop CoLockObjectExternal CoTaskMemAlloc RevokeDragDrop CoTaskMemFree OleUninitialize OleInitialize OleSetClipboard

Solstice 26.34/Solstice 26.3X.dll

IMPHASH c665c5223a58c70f7c5233244c9bfa69
SHA256 53154d375be24ef7766663a29ed69272c33762ad7f9cdfda53129c8cec738a23
MD5 164a0ed1f188fa4a41122b56ab55d44e
SHA1 7333adb7d47d64796ff421cbc80c0d6285af429b
SHA512 8e333d93d7fa7aba7eaae84de216245b8429c3ffce45d3de184c24112ad4a112993acc077716aa0fed513d551ae3bb2d66443a61b739ccf8b4dbb104c3d43a61
SSDEEP 196608:R3hdxcKhNHGYbaEJEPdOR5jgxe54dDFzC4J+UZw9RWaiaWk:Rbx7hRGYbaAE42e5yDF+CItiaWk
TLSH
T1A717AE1A72998194E07BC07DCEC7CE57E6B238084B10A7DB16E0579D2F77EE8097A721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8698028

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\MinecraftDEV\Solstice 1.26.2x\build\Release\Solstice.pdb

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

dbghelp

SymUnloadModule64 SymLoadModuleEx SymInitialize SymSetOptions SymGetModuleBase64 SymGetLineFromAddr64 SymFromAddr SymFunctionTableAccess64 StackWalk64 SymCleanup SymGetOptions

winmm

waveInOpen waveInPrepareHeader waveInClose waveInAddBuffer waveInStart waveInStop waveInUnprepareHeader

d3d12

ord101

d3d11

D3D11On12CreateDevice

d2d1

ord1

dxgi

CreateDXGIFactory

ole32

CoInitializeEx CoCreateInstance PropVariantClear CoInitialize CoUninitialize

kernel32

GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapQueryInformation HeapSize DeleteFileW SetConsoleCtrlHandler GetTimeZoneInformation FlushFileBuffers GetFileSizeEx GetConsoleOutputCP ReadConsoleW SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW MultiByteToWideChar GlobalLock WideCharToMultiByte GlobalUnlock GlobalAlloc GlobalFree CreateEventA WaitForSingleObject CloseHandle GetModuleHandleA LoadLibraryA GetProcAddress QueryPerformanceFrequency QueryPerformanceCounter FreeLibrary VerSetConditionMask IsBadReadPtr VirtualProtect Sleep ExpandEnvironmentStringsA CreateFileA GetFileTime CompareFileTime VirtualFree VirtualQuery GetSystemInfo VirtualAlloc DeleteFileA FindFirstFileA FindNextFileA FindClose AllocConsole SetConsoleTitleA GetStdHandle GetConsoleMode SetConsoleMode FreeConsole GetModuleFileNameA K32GetModuleFileNameExA GetCurrentProcess K32GetModuleInformation GetLastError LoadLibraryExA SetFilePointer ReadFile CreateToolhelp32Snapshot GetCurrentProcessId Module32First TlsFree GetCurrentThreadId FreeEnvironmentStringsW GetTickCount64 GetModuleHandleExW GetModuleHandleW AddVectoredExceptionHandler SetUnhandledExceptionFilter RtlCaptureContext DisableThreadLibraryCalls CreateThread GetFileAttributesA GetDynamicTimeZoneInformation WriteConsoleW WriteFile WriteConsoleA GetConsoleScreenBufferInfo SetConsoleTextAttribute HeapCreate HeapFree Thread32Next Thread32First SuspendThread ResumeThread HeapReAlloc HeapAlloc HeapDestroy GetThreadContext FlushInstructionCache SetThreadContext OpenThread SetLastError GetThreadTimes InitializeCriticalSectionAndSpinCount InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx GetStartupInfoW IsDebuggerPresent InitializeSListHead TerminateProcess UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry GetStringTypeW GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection SetStdHandle EnterCriticalSection CloseThreadpoolWait SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CreateThreadpoolTimer GetSystemTimeAsFileTime GetCurrentProcessorNumber FlushProcessWriteBuffers CreateSemaphoreExW CreateEventExW InitOnceExecuteOnce InitializeCriticalSectionEx WaitForThreadpoolWorkCallbacks CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork SetEnvironmentVariableW GetProcessHeap OutputDebugStringW SetEndOfFile LoadLibraryExW FreeLibraryWhenCallbackReturns ExitProcess ExitThread RtlUnwind TlsAlloc TlsGetValue GetCurrentThread TlsSetValue FreeLibraryAndExitThread Module32Next GetDateFormatW IsThreadAFiber FlsFree FlsSetValue FlsGetValue FlsAlloc GetModuleFileNameW GetFileType FormatMessageA ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TryAcquireSRWLockExclusive TryAcquireSRWLockShared SleepConditionVariableSRW LocalFree GetLocaleInfoEx SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW CreateFileW FindFirstFileW FindFirstFileExW FindNextFileW GetDiskFreeSpaceExW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFinalPathNameByHandleW GetFullPathNameW SetFileAttributesW SetFileInformationByHandle SetFileTime GetTempPathW AreFileApisANSI DeviceIoControl CreateDirectoryExW CopyFileW MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW WaitForSingleObjectEx SwitchToThread GetExitCodeThread GetNativeSystemInfo WakeConditionVariable WakeAllConditionVariable RtlPcToFileHeader RaiseException RtlCaptureStackBackTrace IsProcessorFeaturePresent InitOnceBeginInitialize InitOnceComplete

user32

RegisterClassExA EnumWindows GetWindowTextA GetWindowRect SetWindowTextA GetDpiForWindow SetWindowLongPtrW CallWindowProcW MessageBoxA ShowCursor ClipCursor MonitorFromWindow ReleaseDC GetDC IsWindowUnicode CreateWindowExA SetCapture GetCapture SetProcessDPIAware TrackMouseEvent GetMessageExtraInfo SetCursorPos ClientToScreen GetForegroundWindow GetKeyState LoadCursorA SetCursor SetClipboardData EmptyClipboard CloseClipboard GetClipboardData OpenClipboard DefWindowProcA DestroyWindow UnregisterClassA ReleaseCapture ScreenToClient

gdi32

CreateRectRgn DeleteObject GetDeviceCaps

advapi32

RegOpenKeyExA RegCloseKey RegQueryValueExA

imm32

ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext

d3dcompiler_47

D3DCompile

dwmapi

DwmEnableBlurBehindWindow DwmGetColorizationColor DwmIsCompositionEnabled

bcrypt

BCryptGenRandom BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

oleaut32

SysFreeString GetErrorInfo SetErrorInfo SysStringLen

vcomp140

_vcomp_for_static_simple_init _vcomp_fork _vcomp_for_static_end

Name

.text

Size

9.3MB

Virtual Size

9.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6.7MB

Virtual Size

6.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

627KB

Virtual Size

626KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Solstice 26.34.rar

Solstice 26.34/FateInjector.exe

kernel32

advapi32

comctl32

rpcrt4

uxtheme

msvcp140

msimg32

shlwapi

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

user32

gdi32

winspool.drv

comdlg32

shell32

ole32

generic

Solstice 26.34/Solstice 26.3X.dll

version

dbghelp

winmm

d3d12

d3d11

d2d1

dxgi

ole32

kernel32

user32

gdi32

advapi32

imm32

d3dcompiler_47

dwmapi

bcrypt

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

oleaut32

vcomp140

generic