halo[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
halo.exe
Size 3.4MB
Sample260804-rf3mfssdlg
SHA256 1f587124548aa1c9575b9c52dd3e95ec546231016a6299415e578f080e43ad13
MD5 48b7067549d0aa5d8fc14e38dd82d352
SHA1 a19bc09ae22bb37668db273981d283fd21167503
SHA512 b1cd69ee2069fa4daeb9488181cdbd967df8adb273452fc13e9d7bfdf02c5c17e5cd16fe4d509c7b0cb58f42d245d6f625a1e2921ea7bd7c6711b59436cb25f0
SSDEEP 98304:rjrMDRTHCMbPQRieREoi2ZFo1Tf9fu70sAh1eJ7:3rMDZCMb4RieRoYALe1
TLSH
T1B2F5D0C2F68680B1CB961579104FA73BAA314F58173906C3E3E83D6BADF36E14179E49
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
halo.exe

File Explorer

halo.exe

.exe 3.4MB

halo.exe

IMPHASH 5c6e636ce12b8d4110bb8f4aedf61daf
SHA256 1f587124548aa1c9575b9c52dd3e95ec546231016a6299415e578f080e43ad13
MD5 48b7067549d0aa5d8fc14e38dd82d352
SHA1 a19bc09ae22bb37668db273981d283fd21167503
SHA512 b1cd69ee2069fa4daeb9488181cdbd967df8adb273452fc13e9d7bfdf02c5c17e5cd16fe4d509c7b0cb58f42d245d6f625a1e2921ea7bd7c6711b59436cb25f0
SSDEEP 98304:rjrMDRTHCMbPQRieREoi2ZFo1Tf9fu70sAh1eJ7:3rMDZCMb4RieRoYALe1
TLSH
T1B2F5D0C2F68680B1CB961579104FA73BAA314F58173906C3E3E83D6BADF36E14179E49
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2241364

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\halo\objects\halo\halo.pdb

ws2_32

inet_ntoa recvfrom WSAGetLastError setsockopt sendto socket gethostname WSAStartup gethostbyname inet_addr

dsound

ord9

winmm

timeEndPeriod timeBeginPeriod

kernel32

SetLastError ReadFileEx SystemTimeToFileTime CompareFileTime SetFileTime ReadFile GetFileTime GetSystemTime WriteFile VirtualFree VirtualAlloc ExitProcess GlobalMemoryStatus SetErrorMode QueryPerformanceCounter GlobalAlloc GetFileAttributesA CreateDirectoryA GlobalFree QueryPerformanceFrequency GetCurrentProcessId GlobalReAlloc GetCurrentThread GetTickCount FillConsoleOutputCharacterA GetNumberOfConsoleInputEvents WriteConsoleOutputCharacterA ReadConsoleInputA SetConsoleCursorPosition GetStdHandle WriteConsoleA GetConsoleScreenBufferInfo SetConsoleCursorInfo FillConsoleOutputAttribute GetConsoleCursorInfo GetTimeFormatA GetDateFormatA VirtualQuery GetLocalTime GetModuleFileNameA FreeLibrary FormatMessageA GetProcAddress LoadLibraryA LocalFree SetThreadLocale GetThreadLocale FindFirstFileA CopyFileA FindClose FindNextFileA DeleteFileA GetDiskFreeSpaceExA GetCurrentProcess GlobalLock GetACP GlobalUnlock LocalAlloc GetCurrentDirectoryA GetVersionExA GetLastError SetPriorityClass GetPriorityClass CreateProcessA MultiByteToWideChar GetModuleHandleA GetCurrentThreadId DuplicateHandle RemoveDirectoryA GetFileAttributesExA SetFileAttributesA WideCharToMultiByte GetThreadPriority LoadResource FindResourceExA LockResource CreateFileW SizeofResource FindResourceA FindResourceW GetSystemInfo IsProcessorFeaturePresent lstrcmpiA GetFullPathNameA HeapAlloc GetProcessHeap HeapFree CompareStringA GetStringTypeW GetStringTypeA IsValidCodePage IsValidLocale DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InterlockedExchange RaiseException GetSystemTimeAsFileTime TerminateProcess GetStartupInfoA GetCommandLineA RtlUnwind HeapReAlloc FlushFileBuffers SetHandleCount GetFileType TlsAlloc TlsFree TlsSetValue TlsGetValue LCMapStringA LCMapStringW HeapSize GetTimeZoneInformation GetOEMCP GetCPInfo UnhandledExceptionFilter GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA CreateEventA WaitForSingleObjectEx SleepEx SetEvent VirtualProtect Sleep CreateFileMappingA SetEndOfFile UnmapViewOfFile MapViewOfFile SetFilePointer GetFileSize CreateFileA ExitThread TerminateThread CreateThread ResumeThread CloseHandle ReleaseMutex CreateMutexA GetExitCodeThread SetThreadPriority WaitForSingleObject CompareStringW SetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapDestroy HeapCreate IsBadWritePtr SetUnhandledExceptionFilter IsBadReadPtr IsBadCodePtr GetLocaleInfoW GetTempPathA SetEnvironmentVariableA InitializeCriticalSection

vorbisfile

ov_clear ov_crosslap ov_open_callbacks ov_read

user32

LoadStringA GetParent RemovePropA SendMessageA PtInRect GetCapture SetPropA InvalidateRect GetWindowLongA GetDlgItem EndDialog IsDlgButtonChecked ReleaseCapture SetWindowTextA EnableWindow CallWindowProcA DialogBoxIndirectParamA DialogBoxParamA SetDlgItemTextA CreateDialogIndirectParamA GetPropA GetWindowPlacement FindWindowA CloseClipboard PostQuitMessage IsClipboardFormatAvailable wsprintfA GetClientRect GetDoubleClickTime GetForegroundWindow GetClipboardData DefWindowProcA OpenClipboard ValidateRect DestroyWindow SetActiveWindow RegisterClassExA SetForegroundWindow LoadBitmapA LoadIconA SetFocus GetDC SetCapture ClientToScreen SetWindowPos ShowCursor SetWindowLongA UnregisterClassA CreateWindowExA ReleaseDC ShowWindow AdjustWindowRect MoveWindow MsgWaitForMultipleObjects GetCursorPos GetWindowRect GetDesktopWindow GetKeyState GetAsyncKeyState GetActiveWindow GetSystemMetrics SetCursor MessageBoxA LoadCursorA TranslateMessage PeekMessageA DispatchMessageA

gdi32

SetTextColor CreateFontIndirectA StretchBlt GetObjectA GetDeviceGammaRamp SetDeviceGammaRamp GetDeviceCaps DeleteObject CreateCompatibleDC SelectObject

advapi32

OpenThreadToken RegOpenKeyA CryptHashData CryptDestroyHash CryptCreateHash CryptAcquireContextA CryptReleaseContext CryptGetHashParam GetLengthSid IsValidSecurityDescriptor RegQueryValueExA FreeSid AddAccessAllowedAce RegOpenKeyExA RegCloseKey RegSetValueExA RegCreateKeyExA OpenProcessToken SetSecurityDescriptorGroup AccessCheck DuplicateToken InitializeSecurityDescriptor SetSecurityDescriptorDacl InitializeAcl AllocateAndInitializeSid SetSecurityDescriptorOwner

ole32

CoCreateInstance StringFromGUID2 CoInitialize CoUninitialize CLSIDFromString

oleaut32

VariantInit VariantClear

binkw32

_BinkSetSoundSystem@8 _BinkDoFrame@4 _BinkOpenDirectSound@4 _BinkCopyToBuffer@28 _BinkPause@8 _BinkNextFrame@4 _BinkOpen@8 _BinkWait@4 _BinkClose@4

wininet

InternetQueryOptionA

wsock32

__WSAFDIsSet ntohl htonl ntohs htons getsockname closesocket bind select send WSACleanup inet_ntoa shutdown recv connect

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

236KB

Virtual Size

232KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

168KB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

4KB

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

stxt774

Size

12KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

stxt371

Size

16KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=2, id=25, productName=VS2002 (.NET) build 9466, version=9466,

count=8, id=105, version=2067,

count=53, id=15, productName=VS2003 (.NET) build 3077, version=3077,

count=18, id=96, productName=VS2003 (.NET) build 3077, version=3077,

count=1, id=95, version=2179,

count=2, id=93, version=2067,

count=259, id=95, productName=VS2003 (.NET) build 3077, version=3077,

count=2, id=93, productName=VS2003 (.NET) build 3077, version=3077,

count=1, id=11, version=8799,

count=2, id=25, version=9210,

count=3, id=28, version=9178,

count=9, id=95, version=2067,

count=6, id=18, version=8444,

count=120, id=29, version=9178,

count=341, id=1, productName=Unmarked objects,

count=19, id=93, version=2179,

count=501, id=100, version=3077,

count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,

count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,