Soda[.]lol[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Soda.lol.zip
Size 5.2MB
Sample260808-n7vjdawemb
SHA256 26a52b3bc8dcd62213d5679cc8738e37da61fb5c3afb416101d8e68df50da9bb
MD5 f8e4b3ac6399966b8fec89b88e670e65
SHA1 a6248c6271b2a56f50dc3f5b5e23a3b9fabac4bc
SHA512 a218e680144c0ce0e0d5be12d724b6bd8cfcfbbd1c453c368b438e0a612a11cec92990ab0a5c2a9dd26a0192b7d01025e25a88259f64df2e4543b40fece1642e
SSDEEP 98304:iiO7NS7fnj+0v38QEPb9rsY69SB53o30WjorkRGSSXpeR2Kbb9P:Y7E7fbFEPpx6Ljo44SfRFlP
TLSH
T1A04633DED8C0AA17784A539AAF1F544FC58129776C7D76E5910C1A323822F37F70A836
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Bin/Decompiler.exe
unpack001/Bin/Soda.dll
unpack001/Bin/fa91bc37d6e8.exe
unpack001/Soda.lol.exe

File Explorer

Soda.lol.zip

.zip 5.2MB
Bin/Decompiler.exe

.exe 3.6MB
Bin/Soda.dll

.dll 2.9MB
Bin/fa91bc37d6e8.exe

.exe 77KB
Bin/version.txt

5B
Soda.lol.exe

.exe 8.3MB

Soda.lol.zip

SHA256 26a52b3bc8dcd62213d5679cc8738e37da61fb5c3afb416101d8e68df50da9bb
MD5 f8e4b3ac6399966b8fec89b88e670e65
SHA1 a6248c6271b2a56f50dc3f5b5e23a3b9fabac4bc
SHA512 a218e680144c0ce0e0d5be12d724b6bd8cfcfbbd1c453c368b438e0a612a11cec92990ab0a5c2a9dd26a0192b7d01025e25a88259f64df2e4543b40fece1642e
SSDEEP 98304:iiO7NS7fnj+0v38QEPb9rsY69SB53o30WjorkRGSSXpeR2Kbb9P:Y7E7fbFEPpx6Ljo44SfRFlP
TLSH
T1A04633DED8C0AA17784A539AAF1F544FC58129776C7D76E5910C1A323822F37F70A836
MD5 SHA1 SHA512 SSDEEP TLSH

Bin/Decompiler.exe

IMPHASH 9e6cd97f28380125697c3b850e18b728
SHA256 ee3f01b0ec81a6f30dadaaf918a4c9abdd487f23a3781ea1674b37a2aa9d4179
MD5 7931e593c52df0815f624866f4599c05
SHA1 8fea58c2931e501af948014af6091f8ee2fa1478
SHA512 3427253654ac067cc8d38c2e3fb426c4ca544e9aa168e42d2c7ce65638065b5be2e6611bd99837067cf91176ff866b01cb321bf50638fd7a414063cb75240300
SSDEEP 49152:YlhKSwIHu0fDwc5L+jbw17CRZVG+y/u5YpynL9EkU1/GUfSALm:YKV0Qw15d/CD2/GUfS
TLSH
T1660619657A5BA8BDD15AC87083468A735E2134DB0B36B8FF04C496393FA9FB45B2C314
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2891852

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

medal.pdb

kernel32

GetLastError CloseHandle CreateThread GetSystemInfo Sleep GetModuleHandleA IsProcessorFeaturePresent GetSystemTimeAsFileTime GetProcAddress SetThreadStackGuarantee GetFileType ExitProcess SetFileInformationByHandle SetFileTime CreateFileW GetFullPathNameW SetHandleInformation GetStdHandle GetConsoleMode SetConsoleMode WriteConsoleW GetCurrentThread GetConsoleOutputCP ReleaseMutex CreateMutexA GetCurrentProcessId WaitForSingleObjectEx GetCurrentProcess GetCurrentThreadId GetConsoleScreenBufferInfo GetFinalPathNameByHandleW SetConsoleTextAttribute SetFileCompletionNotificationModes CreateIoCompletionPort GetFileInformationByHandle GetFileInformationByHandleEx GetQueuedCompletionStatusEx WaitForSingleObject SetLastError SwitchToThread PostQueuedCompletionStatus GetSystemTimePreciseAsFileTime SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetProcessHeap HeapReAlloc AddVectoredExceptionHandler GetCommandLineW GetModuleFileNameW GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry LoadLibraryA lstrlenW RtlVirtualUnwind WideCharToMultiByte MultiByteToWideChar HeapAlloc GetEnvironmentVariableW QueryPerformanceFrequency GetModuleHandleW FormatMessageW QueryPerformanceCounter HeapFree

ws2_32

WSAGetLastError send WSASend accept WSAIoctl bind WSAStartup WSACleanup WSASocketW closesocket freeaddrinfo getaddrinfo recv getsockname socket ioctlsocket listen shutdown

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

ntdll

NtDeviceIoControlFile NtCreateFile NtWriteFile NtReadFile NtCancelIoFileEx RtlNtStatusToDosError

bcryptprimitives

ProcessPrng

vcruntime140

memmove _CxxThrowException __C_specific_handler __current_exception __current_exception_context memcmp memcpy __CxxFrameHandler3 memset

api-ms-win-crt-math-l1-1-0

__setusermatherr pow

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _set_app_type _configure_narrow_argv _initialize_narrow_environment _c_exit _register_thread_local_exe_atexit_callback _get_initial_narrow_environment _initterm __p___argc _initialize_onexit_table _register_onexit_function _crt_atexit _initterm_e terminate exit _cexit _exit __p___argv

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Bin/Soda.dll

IMPHASH 6d424e5d4fc2f835ac004ab9d81311da
SHA256 fc3ce437c3ed76e3d77e05d0f2d3f6927829cad25874c19b677283ded6c86417
MD5 dc3eecabc945623481cd0977ab87e044
SHA1 9ac629fb6eb945d4509c05ac8a0322b198f1b3c4
SHA512 c7dac639eb2b008ba935052b6d55b419bbbcb8d16528e5fa8d00333fdc150cdc719d12743fcac871a9ed65123a4b5bbfae9dd5d8c7f17b0779e0fc2db64ef1a0
SSDEEP 49152:JYaq6Kaq6Kaq6Kaq6YMGSgywPogWYW74+t4od2xI7EfocDaslqhJ/iiYfRkuWqkE:YMAyws5HgqhJ/iiYfRku5W
TLSH
T1F6E59E57B6A400ECC077D1B8C7975A13E7B2B4841331ABEB16E48A652F23BE557BE310
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2225952

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ws2_32

getpeername getaddrinfo inet_pton WSASocketW shutdown WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSASetLastError WSAIoctl __WSAFDIsSet select recvfrom sendto gethostname htons getsockname send ntohs connect getsockopt WSAPoll freeaddrinfo ioctlsocket getnameinfo setsockopt WSAGetLastError WSACleanup accept bind closesocket ntohl listen WSAStartup inet_addr socket recv htonl

wldap32

ord301 ord143 ord200 ord30 ord79 ord35 ord33 ord32 ord27 ord26 ord22 ord41 ord50 ord45 ord60 ord211 ord46 ord217

normaliz

IdnToUnicode IdnToAscii

crypt32

CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFindCertificateInStore CertOpenStore CertGetNameStringA CertFreeCertificateChain CertCloseStore CertEnumCertificatesInStore CertOpenSystemStoreW CryptBinaryToStringA CertFreeCertificateContext CertGetCertificateChain CertCreateCertificateContext CryptQueryObject CertCreateCertificateChainEngine CertVerifyCertificateChainPolicy CertFreeCertificateChainEngine

kernel32

GetLocaleInfoEx GetFileAttributesExW WakeAllConditionVariable LocalFree CreateFile2 AreFileApisANSI InitializeSListHead FormatMessageA InitOnceBeginInitialize InitOnceComplete GetCurrentThreadId SleepConditionVariableSRW GetFileInformationByHandleEx CopyFile2 GetFileInformationByHandle GetModuleHandleA MultiByteToWideChar LoadLibraryA QueryPerformanceFrequency GetProcAddress VerSetConditionMask GetModuleHandleW FreeLibrary QueryPerformanceCounter GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetEnvironmentVariableA DisableThreadLibraryCalls VirtualQuery CreateDirectoryW ReadFile GetModuleFileNameA FindFirstFileW GetFileSizeEx HeapFree GetFullPathNameW FindNextFileW GetCurrentProcess WriteFile TerminateProcess RemoveDirectoryW SetFilePointer FindClose GetVolumeInformationA CreateFileW GetFileAttributesW SetFileAttributesW Sleep GetLastError DeleteFileW CloseHandle HeapAlloc GetCurrentProcessId GetProcessHeap GlobalMemoryStatusEx IsBadReadPtr GetComputerNameA GetTickCount64 OutputDebugStringA ReleaseSRWLockExclusive AcquireSRWLockExclusive GetTickCount EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SetEvent WaitForSingleObject CreateEventA GetSystemDirectoryA SetLastError FormatMessageW MoveFileExA WaitForSingleObjectEx GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects SleepEx VerifyVersionInfoW CreateFileA GetSystemTimeAsFileTime

user32

IsIconic SetForegroundWindow ReleaseCapture GetClientRect GetCursorPos ReleaseDC SetCursor SetCapture LoadCursorW BringWindowToTop SetFocus SetLayeredWindowAttributes GetForegroundWindow TrackMouseEvent IsChild SetWindowLongW ClientToScreen SetCursorPos GetMonitorInfoW GetWindowThreadProcessId keybd_event GetSystemMetrics MessageBoxA mouse_event FindWindowA OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetWindowLongW DefWindowProcW AdjustWindowRectEx GetKeyState DestroyWindow GetDC SetWindowPos MonitorFromWindow EnumDisplayMonitors CreateWindowExW ScreenToClient SetWindowTextW RegisterClassExW WindowFromPoint ShowWindow GetCapture

gdi32

GetDeviceCaps

comdlg32

GetOpenFileNameA GetSaveFileNameA

advapi32

CryptGenRandom CryptReleaseContext CryptGetHashParam CryptImportKey CryptSetKeyParam CryptDestroyHash CryptHashData CryptCreateHash CryptDecrypt CryptEncrypt GetCurrentHwProfileA CryptAcquireContextW GetCurrentHwProfileW CryptDestroyKey CryptAcquireContextA

shell32

SHBrowseForFolderA SHGetFolderPathW SHGetPathFromIDListA

ole32

CoTaskMemFree CoCreateInstance CoUninitialize CoInitializeEx

oleaut32

VariantClear SysAllocString SysFreeString

msvcp140

__crtLCMapStringA ?always_noconv@codecvt_base@std@@QEBA_NXZ ??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z ?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ _Thrd_id ?_Random_device@std@@YAIXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xinvalid_argument@std@@YAXPEBD@Z _Mtx_unlock _Query_perf_counter _Mtx_lock ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z _Query_perf_frequency ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ?tolower@?$ctype@D@std@@QEBADD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z _Xtime_get_ticks _Strcoll ?id@?$collate@D@std@@2V0locale@2@A ?id@?$ctype@D@std@@2V0locale@2@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Strxfrm ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Xbad_function_call@std@@YAXXZ ?good@ios_base@std@@QEBA_NXZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Throw_Cpp_error@std@@YAXH@Z ?_Xlength_error@std@@YAXPEBD@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exceptions@std@@YAHXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Id_cnt@id@locale@std@@0HA

d3dcompiler_47

D3DCompile

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext ImmAssociateContextEx ImmSetCandidateWindow

bcrypt

BCryptFinishHash BCryptGetProperty BCryptDestroyHash BCryptHashData BCryptCreateHash BCryptGenRandom BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpWebSocketSend WinHttpOpenRequest WinHttpSetOption WinHttpWebSocketReceive WinHttpCloseHandle WinHttpSendRequest WinHttpWebSocketClose WinHttpWebSocketShutdown WinHttpSetTimeouts WinHttpConnect WinHttpCrackUrl WinHttpWebSocketCompleteUpgrade

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __C_specific_handler_noexcept __std_exception_copy __std_terminate __C_specific_handler __std_type_info_compare strchr __RTtypeid strstr _purecall wcsrchr memcpy memset memcmp strrchr memchr memmove __current_exception __current_exception_context _CxxThrowException __std_type_info_destroy_list

api-ms-win-crt-runtime-l1-1-0

__sys_nerr __sys_errlist _crt_atexit _cexit _initterm_e _execute_onexit_table _initterm _register_onexit_function terminate _errno abort _beginthreadex _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table

api-ms-win-crt-heap-l1-1-0

free realloc malloc calloc _callnewh

api-ms-win-crt-string-l1-1-0

strspn strlen toupper isalnum tolower strcspn isspace strncat strpbrk isgraph isupper isalpha isxdigit iscntrl ispunct isdigit islower _wcsicmp strncpy_s wcscpy_s wcscat_s _stricmp _wcsnicmp strncmp strcmp strncpy _strdup wcslen

api-ms-win-crt-stdio-l1-1-0

_lseeki64 fgets _open fopen __stdio_common_vsscanf feof __stdio_common_vswprintf _read _write fputs _fileno _close fputc _get_stream_buffer_pointers _fseeki64 fsetpos ungetc setvbuf fgetpos fgetc __stdio_common_vsprintf_s __stdio_common_vswprintf_s fread _wfopen fwrite __stdio_common_vsprintf fseek fclose fflush ftell __stdio_common_vfprintf __acrt_iob_func setbuf

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

atoi atof strtod strtoll strtol strtoull wcstombs strtoul

api-ms-win-crt-math-l1-1-0

floorf floor exp fmod fmodf llround cosh cosf log ceilf log10 tanh powf sin log2 sinf logf _dsign ceil ldexp atan2 cos frexp pow atan _fdopen round modf asin sinh acos sqrt tan acosf sqrtf

api-ms-win-crt-time-l1-1-0

clock _gmtime64_s _time64 _gmtime64 _localtime64_s _difftime64 strftime

api-ms-win-crt-filesystem-l1-1-0

_access _lock_file _stat64 _unlink remove _fstat64 _unlock_file

api-ms-win-crt-locale-l1-1-0

___lc_collate_cp_func localeconv ___lc_codepage_func ___lc_locale_name_func

Bin/fa91bc37d6e8.exe

IMPHASH 6a3958d1bc70d823ff3920ba83b9c5eb
SHA256 5d4ec5b61e1becf7bb3745a073f0d9031450e28c581d649d0ba1394df4703653
MD5 dd6d432633069a2f98499ebea3824775
SHA1 2e3fc3bcd68fc2388faea91a9735dea4652f6420
SHA512 8fcc1cd98540596f6e7d8ac8b2f95dee6af54d179305b5143be97077fd1232808d3bf0fdcdf42d7c7a80079d010adf21743cc5e9004796164c2c33c9fd088371
SSDEEP 1536:iR8cAOfEPhn93JPmSNS7oQdBRyo7Z9zgoAm13scsEA:q8csZn93JPFS7o6R7D18csEA
TLSH
T1B173EA258D5950EAD33A9978C8172C06FF51B8854B926BCB6B005ED31E23AD8AF3F301
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

48864

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ntdll

NtQueryObject NtQueryInformationProcess

kernel32

SetConsoleTitleA GetCurrentProcess GetModuleHandleA OpenProcess Sleep GetLastError CloseHandle VirtualProtectEx GetProcAddress VirtualAllocEx ReadProcessMemory CreateProcessA GetStdHandle SetConsoleMode WriteProcessMemory GetLocalTime SetConsoleOutputCP DuplicateHandle VirtualQueryEx K32EnumProcessModulesEx CreateToolhelp32Snapshot Process32NextW Process32FirstW K32GetModuleBaseNameA VirtualQuery GetModuleFileNameA MultiByteToWideChar LocalFree GetFileAttributesExW GetFileInformationByHandleEx GetConsoleMode WideCharToMultiByte FindFirstFileW FindClose GetLocaleInfoEx FormatMessageA InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetModuleHandleW SetUnhandledExceptionFilter CreateFile2 AreFileApisANSI

advapi32

SetNamedSecurityInfoW ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorDacl

msvcp140

?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy memset __std_exception_destroy __std_exception_copy __C_specific_handler _CxxThrowException __current_exception_context __current_exception memmove

api-ms-win-crt-heap-l1-1-0

malloc _callnewh _set_new_mode free

api-ms-win-crt-stdio-l1-1-0

fflush __p__commode _set_fmode __stdio_common_vsprintf_s __stdio_common_vsprintf __acrt_iob_func __stdio_common_vfprintf

api-ms-win-crt-string-l1-1-0

_stricmp wcslen strlen wcscmp _wcsicmp strcmp

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _c_exit abort __p___argc _exit exit _initterm_e _initterm _get_initial_narrow_environment __p___argv _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _configure_narrow_argv terminate _initialize_narrow_environment

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

Soda.lol.exe

IMPHASH 4da3327bcd4a0aa22ce2d516fcd798ef
SHA256 c09c3113d91ac9c2439b6cbb20a5d1442cd1b943e24c139666250bf97b6ceedc
MD5 32bb80a0c363d6c370575483f97fd52a
SHA1 1a0a241c17edfa2b999a8cfcfda97e828d7997ed
SHA512 d87aecf563a983515861237dff29580a9d91c872f6e37dc26e6b8d125fae924b6769205048ae9c38ff688aad28483d87fd8148042d6d591861746236c761cf5b
SSDEEP 98304:/QuFIxgxYQHR1E+UoupDkawnTufgEUZ4f:/QuFIxgxYQHR1bUoupDkjhe
TLSH
T1EE96D5257B5B996CD09BC47482478A62092130DB0B39B9FF4498963C2F7EBF56F38319
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5974912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Soda_lol.pdb

bcryptprimitives

ProcessPrng

advapi32

EventUnregister EventRegister EventWriteTransfer EventSetInformation RegQueryValueExW RegCloseKey RegOpenKeyExW RegGetValueW

ntdll

NtCreateNamedPipeFile RtlNtStatusToDosError RtlGetVersion NtOpenFile NtWriteFile NtReadFile

kernel32

RtlUnwindEx SetUnhandledExceptionFilter InitializeSListHead SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetSystemTimeAsFileTime CloseHandle GetProcAddress Sleep GetModuleHandleA RtlPcToFileHeader RaiseException GetModuleHandleW FindNextFileW GetTempPathW WaitForMultipleObjects SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW MultiByteToWideChar SetEnvironmentVariableW DeleteFileW GetFinalPathNameByHandleW ReleaseMutex CreateMutexA WideCharToMultiByte SwitchToThread GetSystemInfo ExitProcess FindClose FindFirstFileExW GetCommandLineW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler FlsAlloc FlsGetValue CreateDirectoryW GetFileAttributesW GetModuleFileNameW GetLastError LoadLibraryExW FreeLibrary GetFileInformationByHandle GetConsoleMode FlsSetValue FlsFree GetStdHandle GetEnvironmentStringsW EncodePointer GetExitCodeProcess CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetFileInformationByHandleEx CancelIo GetSystemTimePreciseAsFileTime RtlVirtualUnwind GetCurrentThreadId RtlLookupFunctionEntry RtlCaptureContext InitializeCriticalSectionEx WaitForSingleObjectEx CreateFileW OutputDebugStringA OutputDebugStringW GetProcessHeap HeapFree DuplicateHandle GetCurrentProcess LoadLibraryW LoadLibraryA GetOverlappedResult ReadFile ReadFileEx GetCurrentProcessId SetHandleInformation CreateEventW CreateThread QueryPerformanceCounter QueryPerformanceFrequency HeapReAlloc SetFileTime DeleteCriticalSection GetFullPathNameW lstrlenW SetFileInformationByHandle SetLastError SleepEx WriteFileEx WaitForSingleObject FreeEnvironmentStringsW CompareStringOrdinal GetEnvironmentVariableW GetUserDefaultUILanguage LCIDToLocaleName FormatMessageW HeapAlloc LoadLibraryExA

user32

DestroyIcon DispatchMessageA RegisterClassExW IsProcessDPIAware GetDC ReleaseDC RegisterWindowMessageA GetWindow SetPropW SetParent EnumChildWindows IsWindowEnabled RegisterTouchWindow CloseTouchInputHandle GetTouchInputInfo MapWindowPoints EnableWindow SystemParametersInfoA ReleaseCapture GetMessageA GetRawInputData SetFocus ShowWindow SetCapture SetWindowRgn VkKeyScanW DrawTextW GetWindowDC OffsetRect GetWindowRect DestroyMenu TrackPopupMenu SetWindowDisplayAffinity RegisterRawInputDevices PostQuitMessage SetMenu RemoveMenu AppendMenuW InsertMenuW CheckMenuItem SetMenuItemInfoW CreateAcceleratorTableW DestroyAcceleratorTable DrawMenuBar CreatePopupMenu CreateMenu DrawIconEx GetMenuItemInfoW CreateIcon GetKeyboardLayout MsgWaitForMultipleObjectsEx ToUnicodeEx MapVirtualKeyExW GetKeyState GetAsyncKeyState GetKeyboardState SetWindowLongW EnableMenuItem GetSystemMenu SendInput SetForegroundWindow EnumDisplayMonitors SetWindowLongPtrW GetMenu ShowCursor DestroyWindow ClipCursor GetClipCursor IsWindowVisible TranslateAcceleratorW GetParent GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW MonitorFromPoint DefWindowProcW MapVirtualKeyW FlashWindowEx GetMessageW SetWindowTextW IsWindow CreateWindowExW GetWindowTextW AdjustWindowRectEx GetForegroundWindow GetActiveWindow UpdateWindow InvalidateRect SetCursorPos InvalidateRgn SetWindowPos GetWindowLongPtrW SetCursor TrackMouseEvent SystemParametersInfoW GetWindowTextLengthW FillRect GetMenuBarInfo GetSystemMetrics GetMonitorInfoW MonitorFromRect MonitorFromWindow GetCursorPos ClientToScreen GetClientRect GetWindowLongW ScreenToClient LoadCursorW PostMessageW DispatchMessageW TranslateMessage GetUpdateRect PeekMessageW PostThreadMessageW ValidateRect IsIconic SendMessageW RedrawWindow AdjustWindowRect FindWindowExW

comctl32

RemoveWindowSubclass TaskDialogIndirect DefSubclassProc SetWindowSubclass

gdi32

SelectObject DeleteObject CreateRectRgn GetDeviceCaps BitBlt CreateCompatibleDC DeleteDC CreateDIBSection CreateSolidBrush SetBkMode CombineRgn SetTextColor

ole32

RevokeDragDrop OleInitialize RegisterDragDrop CoCreateInstance CoInitializeEx CoCreateFreeThreadedMarshaler CoUninitialize

shlwapi

SHCreateMemStream

shell32

ShellExecuteW SHGetKnownFolderPath DragFinish DragQueryFileW SHAppBarMessage

combase

CoTaskMemFree CoTaskMemAlloc

ws2_32

WSAStartup WSACleanup closesocket getaddrinfo freeaddrinfo connect send WSAGetLastError WSASocketW

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

dwmapi

DwmGetWindowAttribute DwmSetWindowAttribute DwmEnableBlurBehindWindow

oleaut32

SetErrorInfo GetErrorInfo SysFreeString SysStringLen

api-ms-win-crt-math-l1-1-0

pow roundf floor __setusermatherr round trunc

api-ms-win-crt-string-l1-1-0

strcpy_s wcslen wcscmp _wcsicmp

api-ms-win-crt-convert-l1-1-0

_ultow_s wcstol _wtoi

api-ms-win-crt-runtime-l1-1-0

__p___argv _exit exit _initterm_e _initterm _cexit _initialize_narrow_environment _configure_narrow_argv _c_exit _set_app_type _seh_filter_exe _register_thread_local_exe_atexit_callback _initialize_onexit_table _register_onexit_function _crt_atexit terminate abort __p___argc _get_initial_narrow_environment

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode calloc malloc free

Sharing

General

Malware Config

Signatures

File Explorer

Soda.lol.zip

Bin/Decompiler.exe

kernel32

ws2_32

api-ms-win-core-synch-l1-2-0

ntdll

bcryptprimitives

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic

Bin/Soda.dll

ws2_32

wldap32

normaliz

crypt32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

msvcp140

d3dcompiler_47

imm32

bcrypt

winhttp

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic

Bin/fa91bc37d6e8.exe

ntdll

kernel32

advapi32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic

Bin/version.txt

Soda.lol.exe

bcryptprimitives

advapi32

ntdll

kernel32

user32

comctl32

gdi32

ole32

shlwapi

shell32

combase

ws2_32

api-ms-win-core-synch-l1-2-0

dwmapi