CurseXLoader[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
CurseXLoader.zip
Size 103KB
Sample260822-lbbehsxtex
SHA256 2b285ced98171b4d338290d3a9fa963dfa2b2536775c13d279fa0e09b18b6a78
MD5 00ec4b6c96a0c7ded8b2fba77aab1f4c
SHA1 c23536c2db14f9e418e057cbf3f9cc17ec077984
SHA512 4a25e8086f1c25c0d667deaf1a2cfcbf7829da96496a5946e6a916233b2d70e410afdb454c6a076a77bba017711311eb1125e5ebcbadd0fea07cfa987a0161a3
SSDEEP 3072:Pey7SEuhWfYWrJUKlGsbDQVVyIrkZ2GQZ2LkR/k8fAB:hezhWAGPlGqQuH4F2ODfE
TLSH
T1E8A312CABEE668FCEADFA376C1B6C2016D5BAD15D80403EBD15F2520084B0DD5952B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/CurseXLoader.exe

File Explorer

CurseXLoader.zip

.zip 103KB
CurseXLoader.exe

.exe 233KB

CurseXLoader.zip

SHA256 2b285ced98171b4d338290d3a9fa963dfa2b2536775c13d279fa0e09b18b6a78
MD5 00ec4b6c96a0c7ded8b2fba77aab1f4c
SHA1 c23536c2db14f9e418e057cbf3f9cc17ec077984
SHA512 4a25e8086f1c25c0d667deaf1a2cfcbf7829da96496a5946e6a916233b2d70e410afdb454c6a076a77bba017711311eb1125e5ebcbadd0fea07cfa987a0161a3
SSDEEP 3072:Pey7SEuhWfYWrJUKlGsbDQVVyIrkZ2GQZ2LkR/k8fAB:hezhWAGPlGqQuH4F2ODfE
TLSH
T1E8A312CABEE668FCEADFA376C1B6C2016D5BAD15D80403EBD15F2520084B0DD5952B8B
MD5 SHA1 SHA512 SSDEEP TLSH

CurseXLoader.exe

IMPHASH 12bae35a62503697ed46cbf8a2e89d53
SHA256 db00251d338b34742fff78f256bc47a060966a11f34be7cd7de408e33e78c354
MD5 df8a5a40966d245906005f3d2a33055f
SHA1 0b7253efd1898b4c9c572f069910f1102c80de37
SHA512 b273a1cc42f770a74cf494d058951267a35ffd9838c740787d00954f8bccca9b4fc9d2ef7ca27307d3b8aadb46ad08e67ede0a311740542cd6a9111fde295ead
SSDEEP 3072:GOesntNGItDE6dCGDOIU2g0TEDb/BGOadCTkeRQEaf4zF/AKtHHqblxlqt0Q6sze:GKvG6DE6AGx+1adApAK+Az
TLSH
T1B8345B32B65ACC33D68612B4D9A9DFFF916C98328BA221D377D01F6D98501C32635F1A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

154054

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\Git.Projects\Curse-X\CurseX Loader 2.0\bin\Release\Win32\CurseXLoader.pdb

gdiplus

GdipSetStringFormatLineAlign GdipSetStringFormatFlags GdipCreateLineBrushI GdiplusStartup GdiplusShutdown GdipCreateFontFamilyFromName GdipAddPathArcI GdipSetStringFormatAlign GdipAddPathRectangleI GdipDeleteFontFamily GdipCreateStringFormat GdipGetPathGradientPointCount GdipFillEllipseI GdipCreateFont GdipSetStringFormatTrimming GdipClosePathFigure GdipDeleteStringFormat GdipStringFormatGetGenericDefault GdipMeasureString GdipSetClipRectI GdipDrawArcI GdipGetStringFormatFlags GdipRestoreGraphics GdipDrawPath GdipDrawString GdipCloneStringFormat GdipSetPathGradientSurroundColorsWithCount GdipFillRectangleI GdipDeleteGraphics GdipDeletePen GdipCreatePen1 GdipSetPenStartCap GdipAddPathEllipseI GdipDeleteBrush GdipDrawLineI GdipDeleteFont GdipSaveGraphics GdipDrawEllipseI GdipAlloc GdipDeletePath GdipSetPathGradientCenterColor GdipCreatePathGradientFromPath GdipSetSmoothingMode GdipCreatePath GdipCreateSolidFill GdipFillPath GdipFree GdipCreateFromHDC GdipSetPenEndCap GdipSetTextRenderingHint GdipCloneBrush

winhttp

WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpQueryDataAvailable WinHttpCloseHandle WinHttpReadData WinHttpReceiveResponse WinHttpOpenRequest WinHttpOpen WinHttpQueryHeaders

iphlpapi

GetAdaptersInfo

crypt32

CryptStringToBinaryA

advapi32

CryptCreateHash CryptHashData CheckTokenMembership FreeSid AllocateAndInitializeSid CryptReleaseContext CryptGetHashParam CryptAcquireContextW GetUserNameW CryptDestroyHash

bcrypt

BCryptDestroyKey BCryptGenerateSymmetricKey BCryptCreateHash BCryptSetProperty BCryptHashData BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptOpenAlgorithmProvider BCryptDecrypt BCryptGetProperty

kernel32

VirtualAllocEx WaitForSingleObject WriteProcessMemory FreeLibrary GetProcessHeap LoadLibraryA VirtualFree HeapFree GetModuleHandleW GlobalMemoryStatusEx GetProcAddress WideCharToMultiByte GetComputerNameW GetVolumeInformationW GetLastError GetTickCount CreateRemoteThread MultiByteToWideChar CloseHandle Process32FirstW Process32NextW Sleep CreateToolhelp32Snapshot OpenProcess TerminateProcess LocalFree GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent GetCurrentProcess SetUnhandledExceptionFilter VirtualFreeEx GetTickCount64 UnhandledExceptionFilter

user32

CreateWindowExW SetWindowRgn ScreenToClient GetSystemMetrics SetWindowPos RegisterClassExW LoadIconW LoadCursorW SetCapture SetWindowLongW DestroyWindow GetCursorPos BeginPaint EndPaint PostMessageW ShowWindow SetTimer GetClientRect KillTimer GetMessageW DispatchMessageW PeekMessageW SetFocus TranslateMessage PostQuitMessage UpdateWindow InvalidateRect MessageBoxW GetWindowRect DefWindowProcW GetWindowLongW ReleaseCapture SetForegroundWindow

gdi32

CreateCompatibleBitmap SelectObject DeleteObject BitBlt DeleteDC CreateCompatibleDC CreateRoundRectRgn

ole32

CoInitializeEx CoCreateInstance CoSetProxyBlanket CoInitializeSecurity CoUninitialize

oleaut32

SysFreeString SysAllocString VariantClear

msvcp140

??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?good@ios_base@std@@QBE_NXZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?uncaught_exception@std@@YA_NXZ _Thrd_detach ?_Xbad_function_call@std@@YAXXZ ?_Xout_of_range@std@@YAXPBD@Z _Thrd_join _Thrd_id _Cnd_do_broadcast_at_thread_exit ?_Xlength_error@std@@YAXPBD@Z ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z ?_Throw_Cpp_error@std@@YAXH@Z

vcruntime140

_except_handler4_common __current_exception_context __current_exception _CxxThrowException __CxxFrameHandler3 __std_terminate __std_exception_destroy __std_exception_copy memmove memcpy memset

api-ms-win-crt-runtime-l1-1-0

_beginthreadex terminate _controlfp_s _crt_atexit _register_onexit_function _initialize_onexit_table _errno _register_thread_local_exe_atexit_callback _c_exit _cexit _seh_filter_exe _exit exit _initterm_e _initterm _get_narrow_winmain_command_line _initialize_narrow_environment _configure_narrow_argv _set_app_type _invoke_watson

api-ms-win-crt-heap-l1-1-0

free _set_new_mode _callnewh malloc

api-ms-win-crt-convert-l1-1-0

strtoul strtod strtoull strtoll

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vsprintf _set_fmode

api-ms-win-crt-string-l1-1-0

isspace tolower

api-ms-win-crt-math-l1-1-0

_dclass ceil __setusermatherr