VoidlineLauncher.zip
- SHA256 5c0c30570974ec13c439fe749917eeae7d9e3cb914de04b2be414e7808333c1e
Password
voidline
Static task
static1
2 signatures
General
- Target VoidlineLauncher.zip
- Size 1.5MB
- Sample260929-3zalkavz9m
- SHA256 5c0c30570974ec13c439fe749917eeae7d9e3cb914de04b2be414e7808333c1e
- MD5 7491a318d108f8b48d6b92925daaa97e
- SHA1 5b06a4892c327f159cbad62a5e1b7f2307ba2bf9
- SHA512 7509ce8f353945dd777defa92748d02c2adf14b570b24a5bf378b43abef56ed1dd00ad4351616bd9d660560c06567a91680839f3a754e1652ad3c27f3a2ce5b1
- SSDEEP 24576:yVSUqzt6FPRrV9E5VC9CurDnCoR+SwFT77GEo5RIrr6bZkhn+sY2ZQr:yVStUdP9iVfuNR+SwFUTyruahnS2ZQr
- TLSH T1EC753388A8C10D4624BC38E18C19BC914C09BD94EDDB6E2B5ACCE5744606F6FD7EB58F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack001/libcurl.dll - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/libcurl.dll
File Explorer
-
VoidlineLauncher.zip.zip 1.5MB
-
VoidlineLauncher.exe.exe 785KB
-
gup.xml.xml 4KB
-
libcurl.dll.dll 1.4MB
VoidlineLauncher.exe
- IMPHASH 0b43764663ba024c8202f35227fe0bff
- SHA256 eaac64c113ebaba1fae924ad1b6239a44c8806bf2b85d8dc11a27ad65a981cc1
- MD5 bca6478b230b6920fe79b97a3066e835
- SHA1 f61e771c53c63f35f5a2b416c260c74d29329adf
- SHA512 463f16b737768ac2bb285efc09e69781132e95c234e2eab37eb98be797606e45d1dbb38df3a6ef55144f4f7e1b08a213768e915b7d967b8c90bd03b216a07ff7
- SSDEEP 12288:/AstffLBk3Q45wU0/St0Z4j9lAx5ylTxEIyTXnxYV:4s9uQ45oyj9lE5yFuTXmV
- TLSH T1CB058E6A66AC01F8E0B7D17989964907F7B27845137197CF43A087AB2F276E05F7E320
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
voidline
Digest
1b:65:e0:ab:b1:b0:2b:aa:fb:5f:cd:96:90:30:b6:76:7d:fa:2d:44:21:c4:2e:57:95:3b:dc:e4:a6:f6:1f:98
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR
Chains
Mar 7, 2025
CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR
Serial Number
03:aa:64:92:de:9d:96:a9:0a:4b:ca:97:be:ad:b4:4a
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 13, 2022 - May 14, 2025
Subject
CN=DigiCert Timestamp 2024,O=DigiCert,C=US
Serial Number
0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 26, 2024 - Nov 25, 2035
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
261440
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
libcurl
curl_easy_setopt
curl_easy_cleanup
curl_easy_init
curl_easy_perform
comctl32
InitCommonControlsEx
shlwapi
PathFileExistsA
PathFindExtensionW
PathIsDirectoryW
PathFileExistsW
PathFindFileNameW
PathRemoveFileSpecW
kernel32
CreateFileW
HeapSize
SetEndOfFile
HeapReAlloc
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
CreateDirectoryW
lstrlenW
GetCurrentThreadId
Sleep
OutputDebugStringW
DeleteFileW
CreateThread
lstrcpyW
lstrcmpW
MulDiv
MoveFileW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ReleaseSemaphore
InitializeCriticalSection
WriteConsoleW
CreateEventW
GetLastError
SetEvent
CloseHandle
ResetEvent
CreateSemaphoreW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetConsoleOutputCP
WaitForSingleObject
FlushFileBuffers
GetFileSizeEx
HeapAlloc
HeapFree
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
MultiByteToWideChar
WideCharToMultiByte
WakeConditionVariable
TryAcquireSRWLockExclusive
WaitForSingleObjectEx
GetExitCodeThread
RtlUnwind
InitializeCriticalSectionEx
EncodePointer
DecodePointer
GetLocaleInfoEx
LCMapStringEx
GetProcAddress
GetStringTypeW
CompareStringEx
GetCPInfo
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ReadFile
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
GetStdHandle
WriteFile
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetFileType
user32
CallNextHookEx
EndDialog
SetWindowTextW
SetDlgItemTextW
CreateWindowExW
MessageBoxA
UnhookWindowsHookEx
SetWindowsHookExW
GetDlgItemInt
SystemParametersInfoW
SetDlgItemInt
DialogBoxParamW
LoadImageW
ReleaseDC
MessageBoxW
SendMessageW
SetWindowPos
GetDC
GetWindowRect
FindWindowExW
GetDlgItemTextW
gdi32
GetDeviceCaps
shell32
SHGetFolderPathW
ShellExecuteW
SHFileOperationW
Name
.text
Size
595KB
Virtual Size
595KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
134KB
Virtual Size
134KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=190, id=261, version=30795,
count=16, id=260, version=30795,
count=1, id=253, version=33731,
count=10, id=259, version=33731,
count=16, id=260, version=33731,
count=90, id=261, version=33731,
count=12, id=257, version=30795,
count=3, id=257, version=33811,
count=182, id=1, productName=Unmarked objects,
count=35, id=265, version=33811,
count=1, id=255, version=33811,
count=1, id=151,
count=1, id=258, version=33811,
gup.xml
- SHA256 92717951aae89e960b142cef3d273f104051896a3d527a78ca4a88c22b5216a5
- MD5 abde55a0b1cb4a904e622c02f559dcd1
- SHA1 1662f8445a000bbf7c61c40e39266658f169bf13
- SHA512 8fe75fb468f87be1153a6a0d70c0583a355f355bfe988027c88d154b500e97f2c5241d9557ebb981067205e2f23ad07b6a49c669cd3e94eaa728201173b235a0
- SSDEEP 96:rrxgFDl+72Y+WbPRkrm1+U4YeJS2kG6QrABYUCJ8PYPwJrkFI:rVgFhunzbpka1+UNQo2sBCPwJrkFI
- TLSH T19491944B57DCC3770C3112A178AE9191D33409F932B5500138A8809BA36ADA6BBBF7E9
- MD5 SHA1 SHA512 SSDEEP TLSH
libcurl.dll
- IMPHASH 3aab90d9dd9b56e4ac2469bc25e5fa57
- SHA256 43092368141b723b4d00d102c596c4ac1a3914fbf6c180e5fbee5101a6f3d144
- MD5 f22a43372c80ad7416154d4934bfff45
- SHA1 14ff457f74920853c7502737d1e12939f355f409
- SHA512 85473cc0db0e64de9f9f5ee9b2d303bb1c29bca2a68e8c198306e75c521924aa7f81f98cdf4b26cdc149edb8c3b89d5b05da314812420f24fbd79e5a3012c7ea
- SSDEEP 24576:EnxEcv0611SEVSlhEiTz2DOg/7/lS+bt4B/ucemj06Bk1TLtth:I0HTz2DOg/7/lS+h49Zemw8kdxt
- TLSH T14065E1E8A55B53F6F543433BDC2B4247AA983800141CE99227AFFFE07E7188599B42D7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
voidline
Minor OS version
0
Major OS version
6
Entry point
123712
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
CloseHandle
CreateFileW
CreateProcessA
CreateProcessW
ExitProcess
GetProcAddress
GetTempPathW
GetTickCount
LoadLibraryA
Sleep
VirtualAlloc
VirtualFree
WaitForSingleObject
WriteFile
lstrcatA
lstrcatW
lstrcpyW
lstrlenW
curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_option_by_id
curl_easy_option_by_name
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_easy_upkeep
curl_formfree
curl_free
curl_global_cleanup
curl_global_init
curl_multi_add_handle
curl_multi_cleanup
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_share_init
curl_share_setopt
curl_slist_append
curl_slist_free_all
curl_url
curl_url_cleanup
curl_url_dup
curl_version
curl_version_info
curl_ws_send
Name
.a0a85b
Size
478KB
Virtual Size
477KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.95519a
Size
979KB
Virtual Size
979KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.7b3003
Size
512B
Virtual Size
28B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
804B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.3c2b4f
Size
512B
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ