HorizonV3-triage-set 2[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
HorizonV3-triage-set 2.zip
Size 17.3MB
Sample260907-lsavbatepf
SHA256 726e1a0e98c1ef0985bc97ad103bffae4e5b85c0854d40afb6577731fa3a53b9
MD5 7a85d7466ef671b7587e3f802a9544b9
SHA1 5be6bd14d413767f2b200e5fc854771c3792ac5c
SHA512 b6e704b1e2a1ad030749492e01aca10f4979b4266dd5f8b96f6ce4425be2ac9fb32a2703d81fe52ca5591b8259cbf5fc3fce7cb69e31ae0df384d7dfe108c904
SSDEEP 393216:BFyOjGEITmRaqv8ICbtP6dBv7dpDibuOo/WSNGRI7KlyrN:BFyvCR7qbWFdZiaDzNGRI7brN
TLSH
T17A0733E74B7327EA60AB78318EDB32AE1D0DC4165A90ADA6E7740B937D330D7156C10E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/09_app.pyd

File Explorer

HorizonV3-triage-set 2.zip

.zip 17.3MB
00_MANIFEST.txt

1KB
01_ODUOZnteF.class

11KB
02_ingShs.class

147KB
03_eklycroFbwkqgxDqczqnCtij.class

27KB
04_nregmsHunsbu.class

37KB
05_nregmsHunsbu_inner1.class

1KB
06_nregmsHunsbu_inner2.class

1KB
07_nregmsHunsbu_inner3.class

896B
08_main.py

353B
09_app.pyd

.dll 1.8MB
10_app.pyd_encrypted_constants.bin

231KB
11_engine_stego_carrier.png

.png 16.2MB

HorizonV3-triage-set 2.zip

SHA256 726e1a0e98c1ef0985bc97ad103bffae4e5b85c0854d40afb6577731fa3a53b9
MD5 7a85d7466ef671b7587e3f802a9544b9
SHA1 5be6bd14d413767f2b200e5fc854771c3792ac5c
SHA512 b6e704b1e2a1ad030749492e01aca10f4979b4266dd5f8b96f6ce4425be2ac9fb32a2703d81fe52ca5591b8259cbf5fc3fce7cb69e31ae0df384d7dfe108c904
SSDEEP 393216:BFyOjGEITmRaqv8ICbtP6dBv7dpDibuOo/WSNGRI7KlyrN:BFyvCR7qbWFdZiaDzNGRI7brN
TLSH
T17A0733E74B7327EA60AB78318EDB32AE1D0DC4165A90ADA6E7740B937D330D7156C10E
MD5 SHA1 SHA512 SSDEEP TLSH

09_app.pyd

IMPHASH 50f9fe8df2dc9541a8395ddfc3bf57be
SHA256 d03c42c275f0dbc617428441508c49ae1adcbbc95af4eeb094bca4e4f8943f3e
MD5 ca1666b335b285fa80e5759a1908ad6c
SHA1 230896fb9d2892cf08e46d9d85a937a32a925e60
SHA512 a4430a6714f0f5f278bf95d1dd2ec3e2d9ce33a12521a2e06926908e568f4626839a0e257e30bee1342715a540f427bd0b013567f22c8e0fdd53c0e6365301ec
SSDEEP 24576:as1eI/R4pxl7ekJFfBupIFfrVw5eQKAx+gUpVpIgQjGHyCNyCvaz9a:aKeoR4d7ekJFpupIFekpZVyZwm9
TLSH
T18E85191323B40046F6F6D5F74EAA9B23DDB2F9CE1B2232D704A4EA592B83DD256DC144
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1515476

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

python312

_PyArg_NoKeywords PyLong_AsSsize_t PyDictKeys_Type PySlice_Type PyImport_ImportModule PyBytes_AsString PyObject_SelfIter PyEval_GetFuncName PyImport_ExecCodeModuleEx PyUnicode_DecodeUTF8 _PyWeakref_CallableProxyType PyList_Sort PyExc_RuntimeError PyObject_SetAttrString PyNumber_FloorDivide PyUnicode_Concat PyExc_UnboundLocalError _PyErr_WriteUnraisableMsg _PyImport_FixupExtensionObject Py_BuildValue PyComplex_FromDoubles PyObject_GetAttr PyModule_GetName PyBytes_FromString PyModule_GetDef _PyObject_GC_Resize PyTuple_New PyLong_FromString _Py_EllipsisObject PyDict_SetItemString PyFrame_Type PyFloat_FromDouble PyDictValues_Type PyUnicode_New PyObject_LengthHint PyUnicode_FromWideChar _PyWeakref_ClearRef PyMarshal_ReadObjectFromString PyExc_ZeroDivisionError PyObject_CallFunction PyIter_Next PyObject_GetIter PyNumber_Add PyIter_Send PyUnicode_InternInPlace PyNumber_InPlaceLshift PyObject_RichCompare PyCoro_Type PyNumber_InPlaceAdd PyFloat_Type PyModule_NewObject PyMethod_Type PyNumber_Subtract PySys_SetObject PyExc_OverflowError _Py_Dealloc PyObject_Free PyImport_ImportFrozenModule PyErr_ExceptionMatches PyUnicode_FindChar PyObject_GC_Del PyObject_CallFunctionObjArgs PyLong_AsLong PyLong_FromUnicodeObject PyObject_ClearWeakRefs PyObject_Init PyCode_Type PyUnicode_AsWideCharString PyErr_WarnEx PyList_New PyType_Ready PyModule_FromDefAndSpec2 Py_CompileStringExFlags PyList_Append PyObject_RichCompareBool PySet_Type _PyLong_New PyObject_GenericSetAttr PyDict_New _PyDict_MaybeUntrack _PyErr_ChainStackItem PyFrozenSet_New PyByteArray_FromStringAndSize PyModule_ExecDef _PyEval_EvalFrameDefault PyLong_AsLongAndOverflow PyCMethod_New _PySet_NextEntry PyErr_NoMemory PyObject_Realloc _PyRuntime PyDict_GetItemString PyEllipsis_Type PyDict_GetItem PyImport_FrozenModules PyComplex_Type _Py_NotImplementedStruct PyUnstable_Code_NewWithPosOnlyArgs PyExc_StopAsyncIteration PyArg_ParseTupleAndKeywords PyImport_ExecCodeModule _PyWeakref_ProxyType _PyObject_New PyObject_IsTrue PyObject_Str PyExc_NameError _PyByteArray_empty_string PyCallable_Check PyMem_Malloc _PyErr_NormalizeException PyDict_MergeFromSeq2 PyModuleDef_Type PyGen_Type PyObject_CallMethodObjArgs PyArg_UnpackTuple PyModule_GetState _PyWeakref_RefType PyAsyncGen_Type PyErr_Print PyTraceBack_Type _PyTuple_MaybeUntrack PyRange_Type Py_GenericAliasType _PyLong_Copy _PyType_Lookup PyObject_Call PyObject_Repr PyByteArray_Type PyArg_ParseTuple PyEval_RestoreThread PyUnicode_FromStringAndSize PyStructSequence_InitType PyDictItems_Type PyMem_GetAllocator PyOS_snprintf PyCFunction_Type PyObject_SetAttr PyBaseObject_Type PyExc_ImportWarning PyNumber_InPlaceOr PySequence_List PyByteArray_FromObject PyFrozenSet_Type PyModule_GetFilenameObject _PyAsyncGenWrappedValue_Type PyExc_WindowsError PyObject_GetItem PyLong_Type PyExc_OSError PySet_Contains PyNumber_Negative PyObject_SetItem PyExc_FileNotFoundError PyExc_ImportError PyLong_FromSsize_t PyObject_IsInstance PyTuple_Type PyExc_KeyError Py_Exit PyExc_GeneratorExit PyObject_IsSubclass PyErr_WriteUnraisable PyBytes_Type PyUnicode_Substring PyUnicode_GetLength PyUnicode_Find PyExc_SystemExit PySequence_Tuple PyType_Type PyEval_AcquireThread _PyThreadState_GetCurrent PyExc_SystemError PyExc_IndexError PyModule_Type PyExc_TypeError PyNumber_AsSsize_t PyUnicode_Compare PyNumber_Long PyDict_DelItem PyModuleDef_Init PyList_Type PyExc_StopIteration PyUnicode_Type PySequence_Check PyDict_SetItem PyObject_GetAttrString PySet_New PyUnicode_FromFormat PyUnicode_AsUTF8 PyEnum_Type PyModule_GetDict PyImport_GetModuleDict PyUnicode_Join PyType_IsSubtype PySeqIter_Type PyBool_Type PyExc_BaseException PyDict_Type PyErr_Format PyExc_ValueError PyExc_AttributeError PySet_Add PySequence_Contains PyEval_SaveThread PyDict_Update PyErr_PrintEx PyExc_Exception PyThreadState_Get Py_MakePendingCalls _PyDict_NewPresized PyFunction_Type Py_GenericAlias PyUnicode_FromString _Py_TrueStruct PyCapsule_New _Py_FalseStruct PyStructSequence_New _Py_NoneStruct PySys_GetObject PyErr_BadArgument

kernel32

GetShortPathNameW GetModuleFileNameW SetErrorMode FindResourceA GetModuleHandleExA GetLastError LockResource LoadResource GetProcAddress GetCurrentProcessId GetSystemTimeAsFileTime FormatMessageA LoadLibraryExW QueryPerformanceCounter GetCurrentThreadId DisableThreadLibraryCalls InitializeSListHead

vcruntime140

memset memcpy memcmp __std_type_info_destroy_list strchr strrchr __C_specific_handler

api-ms-win-crt-runtime-l1-1-0

_initterm _initterm_e _seh_filter_dll _configure_narrow_argv _initialize_onexit_table _execute_onexit_table _cexit abort _initialize_narrow_environment

api-ms-win-crt-heap-l1-1-0

malloc free

api-ms-win-crt-stdio-l1-1-0

puts __acrt_iob_func __stdio_common_vsprintf __stdio_common_vfprintf

api-ms-win-crt-string-l1-1-0

_strdup _wcsdup strcmp strcpy strlen strncmp strncpy

api-ms-win-crt-math-l1-1-0

copysign

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char

Sharing

General

Malware Config

Signatures

File Explorer

HorizonV3-triage-set 2.zip

00_MANIFEST.txt

01_ODUOZnteF.class

02_ingShs.class

03_eklycroFbwkqgxDqczqnCtij.class

04_nregmsHunsbu.class

05_nregmsHunsbu_inner1.class

06_nregmsHunsbu_inner2.class

07_nregmsHunsbu_inner3.class

08_main.py