haloce-patch-1[.]0[.]10[.]exe

General

Target
haloce-patch-1.0.10.exe
Size 3.1MB
Sample260804-ptxbgseq2x
SHA256 388d75a50a492651f0099330f54d45f0b1fc636e339e0161561a83368c6c3dc2
MD5 61ddb72b0d2318e327cf7bcecb73436b
SHA1 54fd41520f342cbd2f8f39971e9b2db1780c492c
SHA512 752f003bf72c58cdc9a98000ae944daa861ed1ef4edd6661b52ab58d1931eda3a38460978b29ba6f25dfce531f2db27e013a979f5bddfd2ae3bdfbaef7392b98
SSDEEP 98304:vRhNmxEUbD0JFRkTx/ziEfluqB4hCGlhR6LPP4t:vRhNqErkTNWEtXmlhUT4t
TLSH
T1E2E5334096FD46FAC6D00570A9CBDE94A439BD212DE2083F1B5BBA47E9FC140F7A06B1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
haloce-patch-1.0.10.exe

File Explorer

haloce-patch-1.0.10.exe

.exe 3.1MB

haloce-patch-1.0.10.exe

IMPHASH f13143b539ba88392099aac7178566d1
SHA256 388d75a50a492651f0099330f54d45f0b1fc636e339e0161561a83368c6c3dc2
MD5 61ddb72b0d2318e327cf7bcecb73436b
SHA1 54fd41520f342cbd2f8f39971e9b2db1780c492c
SHA512 752f003bf72c58cdc9a98000ae944daa861ed1ef4edd6661b52ab58d1931eda3a38460978b29ba6f25dfce531f2db27e013a979f5bddfd2ae3bdfbaef7392b98
SSDEEP 98304:vRhNmxEUbD0JFRkTx/ziEfluqB4hCGlhR6LPP4t:vRhNqErkTNWEtXmlhUT4t
TLSH
T1E2E5334096FD46FAC6D00570A9CBDE94A439BD212DE2083F1B5BBA47E9FC140F7A06B1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

62:26:96:72:d3:87:25:5f:02:59:cf:fc:27:c2:39:bc:b4:52:65:d5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Bungie Inc.,O=Bungie Inc.,L=Bellevue,ST=Washington,C=US

Chains

Dec 12, 2014

CN=Bungie Inc.,O=Bungie Inc.,L=Bellevue,ST=Washington,C=US

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Serial Number

07

Issuer

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 3, 2011 - May 3, 2031

Subject

CN=Bungie Inc.,O=Bungie Inc.,L=Bellevue,ST=Washington,C=US

Serial Number

27:e2:b9:92:1f:82:99

Issuer

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 12, 2014 - May 12, 2015

Minor OS version

0

Major OS version

4

Entry point

7725

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\halopc\haloce\objects\hulaunch_r\hulaunch.pdb

kernel32

GetLastError CopyFileA LockResource GetModuleFileNameA GetModuleHandleA OutputDebugStringA CloseHandle GetCurrentProcessId VirtualProtect CreateProcessA FlushFileBuffers GetStringTypeW GetStringTypeA LCMapStringW MultiByteToWideChar LCMapStringA HeapSize SetStdHandle VirtualQuery InterlockedExchange SizeofResource GetFileAttributesA FormatMessageA LoadResource GetLocaleInfoA FindResourceA GetStartupInfoA GetCommandLineA GetVersionExA ExitProcess GetProcAddress TerminateProcess GetCurrentProcess WriteFile GetStdHandle UnhandledExceptionFilter FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType HeapDestroy HeapCreate VirtualFree HeapFree SetFilePointer HeapAlloc QueryPerformanceCounter GetTickCount GetCurrentThreadId GetSystemTimeAsFileTime LoadLibraryA GetACP GetOEMCP GetCPInfo VirtualAlloc HeapReAlloc RtlUnwind GetSystemInfo

user32

LoadStringA LoadIconA MessageBoxA CreateWindowExA DefWindowProcA ShowWindow GetSystemMetrics UpdateWindow AdjustWindowRect LoadCursorA RegisterClassA

gdi32

GetStockObject

advapi32

RegOpenKeyExA RegQueryValueExA RegCloseKey

Sharing

General

Malware Config

Signatures

File Explorer

haloce-patch-1.0.10.exe

kernel32

user32

gdi32

advapi32

generic