General

  • Target
    StrataWX_Setup_SkyBound.exe
  • Size 184.5MB
  • Sample260928-xfd7rastes
  • SHA256 a998cc60a763c25f662454133c76d6ab93b6578a526df0720e99f33fcef7ce8f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10

Malware Config

Signatures

  • Codesign digest Mismatch 1 IoCs

    File was altered after it was signed.

  • DLL Hijacking vulnerability 1 IoCs

    Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.

  • SVG with JS event handler 1 IoCs
  • Suspicious SVG script tag 1 IoCs
  • Unsigned PE 12 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • StrataWX_Setup_SkyBound.exe
    .exe 184.5MB
  • $PLUGINSDIR/app.7z
    .7z 184.2MB
  • LICENSE.electron.txt
    1KB
  • LICENSES.chromium.html
    8.7MB
  • StrataWx Setup.exe
    .exe 180.4MB
  • chrome_100_percent.pak
    148KB
  • chrome_200_percent.pak
    223KB
  • d3dcompiler_47.dll
    .dll 4.7MB
  • ffmpeg.dll
    .dll 2.8MB
  • icudtl.dat
    10.0MB
  • libEGL.dll
    .dll 481KB
  • libGLESv2.dll
    .dll 8.0MB
  • locales/af.pak
    520KB
  • locales/am.pak
    840KB
  • locales/ar.pak
    921KB
  • locales/bg.pak
    959KB
  • locales/bn.pak
    1.2MB
  • locales/ca.pak
    584KB
  • locales/cs.pak
    602KB
  • locales/da.pak
    545KB
  • locales/de.pak
    582KB
  • locales/el.pak
    1.0MB
  • locales/en-GB.pak
    474KB
  • locales/en-US.pak
    478KB
  • locales/es-419.pak
    575KB
  • locales/es.pak
    575KB
  • locales/et.pak
    523KB
  • locales/fa.pak
    855KB
  • locales/fi.pak
    534KB
  • locales/fil.pak
    604KB
  • locales/fr.pak
    622KB
  • locales/gu.pak
    1.2MB
  • locales/he.pak
    751KB
  • locales/hi.pak
    1.3MB
  • locales/hr.pak
    581KB
  • locales/hu.pak
    625KB
  • locales/id.pak
    516KB
  • locales/it.pak
    567KB
  • locales/ja.pak
    691KB
  • locales/kn.pak
    1.4MB
  • locales/ko.pak
    585KB
  • locales/lt.pak
    629KB
  • locales/lv.pak
    628KB
  • locales/ml.pak
    1.4MB
  • locales/mr.pak
    1.2MB
  • locales/ms.pak
    541KB
  • locales/nb.pak
    525KB
  • locales/nl.pak
    543KB
  • locales/pl.pak
    604KB
  • locales/pt-BR.pak
    567KB
  • locales/pt-PT.pak
    571KB
  • locales/ro.pak
    592KB
  • locales/ru.pak
    972KB
  • locales/sk.pak
    611KB
  • locales/sl.pak
    587KB
  • locales/sr.pak
    903KB
  • locales/sv.pak
    528KB
  • locales/sw.pak
    557KB
  • locales/ta.pak
    1.4MB
  • locales/te.pak
    1.3MB
  • locales/th.pak
    1.1MB
  • locales/tr.pak
    567KB
  • locales/uk.pak
    972KB
  • locales/ur.pak
    850KB
  • locales/vi.pak
    673KB
  • locales/zh-CN.pak
    484KB
  • locales/zh-TW.pak
    479KB
  • resources.pak
    5.5MB
  • resources/app.asar
    .js 159KB
  • resources/app.zip
    .zip 120.2MB
  • LICENSE.electron.txt
    1KB
  • LICENSES.chromium.html
    8.7MB
  • StrataWx.exe
    .exe 180.4MB
  • chrome_100_percent.pak
    148KB
  • chrome_200_percent.pak
    223KB
  • d3dcompiler_47.dll
    .dll 4.7MB
  • ffmpeg.dll
    .dll 2.8MB
  • icudtl.dat
    10.0MB
  • libEGL.dll
    .dll 481KB
  • libGLESv2.dll
    .dll 8.0MB
  • locales\af.pak
    520KB
  • locales\am.pak
    840KB
  • locales\ar.pak
    921KB
  • locales\bg.pak
    959KB
  • locales\bn.pak
    1.2MB
  • locales\ca.pak
    584KB
  • locales\cs.pak
    602KB
  • locales\da.pak
    545KB
  • locales\de.pak
    582KB
  • locales\el.pak
    1.0MB
  • locales\en-GB.pak
    474KB
  • locales\en-US.pak
    478KB
  • locales\es-419.pak
    575KB
  • locales\es.pak
    575KB
  • locales\et.pak
    523KB
  • locales\fa.pak
    855KB
  • locales\fi.pak
    534KB
  • locales\fil.pak
    604KB
  • locales\fr.pak
    622KB
  • locales\gu.pak
    1.2MB
  • locales\he.pak
    751KB
  • locales\hi.pak
    1.3MB
  • locales\hr.pak
    581KB
  • locales\hu.pak
    625KB
  • locales\id.pak
    516KB
  • locales\it.pak
    567KB
  • locales\ja.pak
    691KB
  • locales\kn.pak
    1.4MB
  • locales\ko.pak
    585KB
  • locales\lt.pak
    629KB
  • locales\lv.pak
    628KB
  • locales\ml.pak
    1.4MB
  • locales\mr.pak
    1.2MB
  • locales\ms.pak
    541KB
  • locales\nb.pak
    525KB
  • locales\nl.pak
    543KB
  • locales\pl.pak
    604KB
  • locales\pt-BR.pak
    567KB
  • locales\pt-PT.pak
    571KB
  • locales\ro.pak
    592KB
  • locales\ru.pak
    972KB
  • locales\sk.pak
    611KB
  • locales\sl.pak
    587KB
  • locales\sr.pak
    903KB
  • locales\sv.pak
    528KB
  • locales\sw.pak
    557KB
  • locales\ta.pak
    1.4MB
  • locales\te.pak
    1.3MB
  • locales\th.pak
    1.1MB
  • locales\tr.pak
    567KB
  • locales\uk.pak
    972KB
  • locales\ur.pak
    850KB
  • locales\vi.pak
    673KB
  • locales\zh-CN.pak
    484KB
  • locales\zh-TW.pak
    479KB
  • resources.pak
    5.5MB
  • resources/app.asar
    54.3MB
  • resources\app.asar.unpacked\build\icon.png
    .png 19KB
  • resources\app.asar.unpacked\engine\airport-db.data.json
    3.4MB
  • resources\app.asar.unpacked\engine\engine.mjs
    .sh .js 1.2MB
  • resources\stratawx-panel-2020\InGamePanels\InGamePanel_StrataWx.spb
    663B
  • resources\stratawx-panel-2020\html_ui\InGamePanels\StrataWx\index.html
    .html .js 75KB
  • resources\stratawx-panel-2020\html_ui\InGamePanels\StrataWx\panel_code.js
    917B
  • resources\stratawx-panel-2020\html_ui\InGamePanels\StrataWx\stratawx_worker.js
    .js 218KB
  • resources\stratawx-panel-2020\html_ui\icons\toolbar\ICON_TOOLBAR_STRATAWX.svg
    .svg .js 5KB
  • resources\stratawx-panel-2020\layout.json
    753B
  • resources\stratawx-panel-2020\manifest.json
    431B
  • resources\stratawx-panel\InGamePanels\InGamePanel_StrataWx.spb
    663B
  • resources\stratawx-panel\html_ui\InGamePanels\StrataWx\index.html
    .html .js 75KB
  • resources\stratawx-panel\html_ui\InGamePanels\StrataWx\panel_code.js
    917B
  • resources\stratawx-panel\html_ui\InGamePanels\StrataWx\stratawx_worker.js
    .js 218KB
  • resources\stratawx-panel\html_ui\icons\toolbar\ICON_TOOLBAR_STRATAWX.svg
    .svg .js 5KB
  • resources\stratawx-panel\layout.json
    753B
  • resources\stratawx-panel\manifest.json
    432B
  • snapshot_blob.bin
    309KB
  • v8_context_snapshot.bin
    671KB
  • vk_swiftshader.dll
    .dll 5.3MB
  • vk_swiftshader_icd.json
    106B
  • vulkan-1.dll
    .dll 874KB
  • resources/elevate.exe
    .exe 120KB
  • snapshot_blob.bin
    309KB
  • v8_context_snapshot.bin
    671KB
  • vk_swiftshader.dll
    .dll 5.3MB
  • vk_swiftshader_icd.json
    106B
  • vulkan-1.dll
    .dll 874KB
  • $PLUGINSDIR/nsis7z.dll
    .dll 424KB

StrataWX_Setup_SkyBound.exe

  • IMPHASH 573bb7b41bc641bd95c0f5eec13c233b
  • SHA256 a998cc60a763c25f662454133c76d6ab93b6578a526df0720e99f33fcef7ce8f
  • MD5 SHA1 SHA512 SSDEEP TLSH
  • Unsigned PE

    Checks for missing Authenticode signature.

Minor OS version
0
Major OS version
4
Entry point
13709
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE
PDB paths