Howl_patched[.]exe

Resubmissions

03/10/2026, 18:53

261003-xjk5gawt2l3

03/10/2026, 18:51

261003-xhydeaveph3

Sharing

Copy URL Twitter E-mail

General

Target
Howl_patched.exe
Size 22.9MB
Sample261003-xhydeaveph
SHA256 15a4adc1c7d652a98cb7483fa8427d365c27934b7805295ad5d193354eb46ae6
MD5 4e134d06e2c71a675a2e3c65f22e3e93
SHA1 ddc0698948ba312a95ab8ed2d3e30279f607424c
SHA512 212a07556f2fdb5675edffefe64c87e3e9190bd6a3824f50219280c08f9c4cd63a542be2e750a887c54a64dd1d71dfcdea62ac7b7ef037bc57efffda9a39b9aa
SSDEEP 196608:8EcdLzccSkcX26JKsp+Xvr+h7wDSZ8Mx5:pcLQcSkcX26JKsp+XT+hPPx5
TLSH
T18C37F142B3DC45DEDF22A97889525A43C3E6F808172143F7BBCE496A5A3BDE00B7D641
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Howl_patched.exe

File Explorer

Howl_patched.exe

.exe 22.9MB

Howl_patched.exe

IMPHASH 783532965d61afd2313bde9456461e08
SHA256 15a4adc1c7d652a98cb7483fa8427d365c27934b7805295ad5d193354eb46ae6
MD5 4e134d06e2c71a675a2e3c65f22e3e93
SHA1 ddc0698948ba312a95ab8ed2d3e30279f607424c
SHA512 212a07556f2fdb5675edffefe64c87e3e9190bd6a3824f50219280c08f9c4cd63a542be2e750a887c54a64dd1d71dfcdea62ac7b7ef037bc57efffda9a39b9aa
SSDEEP 196608:8EcdLzccSkcX26JKsp+Xvr+h7wDSZ8Mx5:pcLQcSkcX26JKsp+XT+hPPx5
TLSH
T18C37F142B3DC45DEDF22A97889525A43C3E6F808172143F7BBCE496A5A3BDE00B7D641
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

Minor OS version

Major OS version

Entry point

3246256

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize InitOnceComplete SleepConditionVariableSRW Sleep WakeAllConditionVariable

api-ms-win-core-heap-l2-1-0

LocalFree GlobalAlloc GlobalFree

api-ms-win-core-errorhandling-l1-1-0

GetLastError SetUnhandledExceptionFilter

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionEx WaitForSingleObject ReleaseSRWLockShared SetWaitableTimer CreateWaitableTimerExW SetEvent DeleteCriticalSection AcquireSRWLockShared CreateEventW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l1-1-0

HeapDestroy GetProcessHeap HeapAlloc HeapSize HeapReAlloc HeapFree

api-ms-win-security-base-l1-1-0

GetLengthSid IsValidSid GetTokenInformation CopySid

api-ms-win-security-sddl-ansi-l1-1-0

ConvertSidToStringSidA

api-ms-win-core-processthreads-l1-1-0

GetProcessId SuspendThread ResumeThread GetCurrentThread GetCurrentThreadId OpenProcessToken GetCurrentProcess OpenThread TerminateProcess SetThreadPriority GetCurrentProcessId

api-ms-win-core-string-l1-1-0

MultiByteToWideChar WideCharToMultiByte

api-ms-win-core-toolhelp-l1-1-0

Thread32First CreateToolhelp32Snapshot Process32NextW Process32FirstW Thread32Next

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW LoadLibraryExW GetModuleHandleA GetProcAddress GetModuleHandleW FreeLibrary

api-ms-win-core-processthreads-l1-1-1

GetThreadContext OpenProcess

api-ms-win-core-debug-l1-1-0

OutputDebugStringW OutputDebugStringA IsDebuggerPresent

api-ms-win-core-debug-l1-1-1

CheckRemoteDebuggerPresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter QueryPerformanceFrequency

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

api-ms-win-core-com-l1-1-0

CoCreateGuid CoCreateFreeThreadedMarshaler CoInitializeEx

winhttp

WinHttpReceiveResponse WinHttpSendRequest WinHttpCrackUrl WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpCloseHandle WinHttpSetTimeouts WinHttpConnect WinHttpOpen WinHttpAddRequestHeaders WinHttpReadData WinHttpSetOption WinHttpQueryHeaders

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableA GetCurrentDirectoryW GetStdHandle

api-ms-win-core-console-l2-1-0

FillConsoleOutputAttribute SetConsoleCursorPosition SetConsoleTextAttribute FillConsoleOutputCharacterA SetConsoleCursorInfo GetConsoleScreenBufferInfoEx SetConsoleScreenBufferInfoEx SetConsoleWindowInfo SetConsoleScreenBufferSize GetConsoleScreenBufferInfo

api-ms-win-core-console-l2-2-0

SetConsoleTitleA

api-ms-win-core-console-l3-2-0

GetConsoleWindow SetCurrentConsoleFontEx

api-ms-win-core-console-l1-1-0

GetConsoleMode SetConsoleCtrlHandler SetConsoleMode

api-ms-win-mm-time-l1-1-0

timeBeginPeriod timeEndPeriod

api-ms-win-core-synch-l1-2-1

CreateWaitableTimerW

d3dcompiler_47

D3DCompile

api-ms-win-core-memory-l1-1-0

VirtualAllocEx VirtualQueryEx ReadProcessMemory VirtualProtectEx

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime GetTickCount GetTickCount64 GetSystemInfo GetLocalTime

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-file-l1-1-0

GetFileAttributesExW GetFinalPathNameByHandleW SetFileInformationByHandle FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW FindNextFileW ReadFile GetFileSize CreateFileW

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock GlobalLock

api-ms-win-core-localization-l1-2-0

GetGeoInfoW GetUserGeoID GetLocaleInfoEx FormatMessageA GetLocaleInfoA

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-2

Process32Next Process32First

kernel32

GetFileSizeEx VerifyVersionInfoW WaitForMultipleObjects PeekNamedPipe GetFileType WaitForSingleObjectEx MoveFileExW SleepEx LoadLibraryW LeaveCriticalSection EnterCriticalSection InitializeCriticalSection AcquireSRWLockExclusive ReleaseSRWLockExclusive FormatMessageW SetLastError SetDllDirectoryW SetDefaultDllDirectories AddDllDirectory GetModuleFileNameA UnmapViewOfFile MapViewOfFile CreateFileMappingW VirtualProtect GetSystemDirectoryW CreateThread AddVectoredExceptionHandler GetFileAttributesA Module32Next Module32First Module32NextW Module32FirstW GlobalFindAtomA

user32

SetCapture SetCursor SetProcessDPIAware IsWindowUnicode ReleaseCapture GetClipboardData CloseClipboard SetClipboardData EmptyClipboard OpenClipboard SetCursorPos GetKeyboardLayout TrackMouseEvent SendInput DispatchMessageA TranslateMessage PeekMessageA SetWindowDisplayAffinity DestroyWindow UpdateWindow GetWindowRect CreateWindowExA RegisterClassExA ClientToScreen IsIconic SetFocus BringWindowToTop SetForegroundWindow MapVirtualKeyA GetCapture PostQuitMessage GetClientRect ScreenToClient GetCursorPos EnumWindows IsWindow GetClassNameA IsWindowVisible GetWindowThreadProcessId GetAsyncKeyState SystemParametersInfoA ShowScrollBar SendMessageA SetClassLongPtrA SetLayeredWindowAttributes SetWindowLongPtrA GetWindowLongPtrA DrawMenuBar GetSystemMenu DeleteMenu SetWindowPos SetWindowLongA GetWindowLongA CallWindowProcA DefWindowProcA ShowWindow ReleaseDC GetDC FindWindowA UnregisterClassA GetKeyNameTextA LoadCursorA GetMessageExtraInfo GetKeyState GetForegroundWindow PrintWindow MessageBoxA AttachThreadInput

gdi32

CreateCompatibleDC BitBlt SelectObject CreateDIBSection DeleteObject DeleteDC

comdlg32

GetOpenFileNameA

advapi32

CryptAcquireContextW RegDeleteKeyA CryptEncrypt CryptImportKey CryptDestroyKey SystemFunction036 CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext RegCreateKeyExA AddAccessAllowedAce InitializeAcl SetSecurityInfo

shell32

ShellExecuteA

msvcp140

?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z _Cnd_broadcast _Cnd_signal ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?id@?$ctype@D@std@@2V0locale@2@A ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??Bios_base@std@@QEBA_NXZ _Mtx_unlock _Mtx_lock _Thrd_id _Thrd_join ?_Random_device@std@@YAIXZ ?_Xbad_alloc@std@@YAXXZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ _Mtx_trylock ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Xbad_function_call@std@@YAXXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z _Cnd_do_broadcast_at_thread_exit ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z _Strxfrm ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z _Thrd_detach ?_Throw_Cpp_error@std@@YAXH@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A _Query_perf_frequency _Query_perf_counter ?uncaught_exceptions@std@@YAHXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Xtime_get_ticks ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z __crtLCMapStringA ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$collate@D@std@@2V0locale@2@A _Strcoll ?tolower@?$ctype@D@std@@QEBADD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??7ios_base@std@@QEBA_NXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z

crypt32

CertFindExtension CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertGetCertificateChain CertFreeCertificateChain CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore

ws2_32

recv htons getsockname setsockopt socket getpeername WSAIoctl connect bind WSACleanup WSAStartup __WSAFDIsSet select accept htonl ntohs WSAGetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt inet_ntop gethostname inet_pton freeaddrinfo getaddrinfo ioctlsocket sendto ntohl listen recvfrom WSASetLastError

shlwapi

PathFindFileNameW

userenv

UnloadUserProfile

dwmapi

DwmSetWindowAttribute DwmExtendFrameIntoClientArea DwmEnableBlurBehindWindow

d3d11

D3D11CreateDeviceAndSwapChain

winmm

PlaySoundW

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

psapi

GetModuleInformation

wintrust

WinVerifyTrust

dnsapi

DnsFree DnsQuery_A

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException longjmp __RTtypeid __std_type_info_compare strstr memmove memset __C_specific_handler strchr memchr __std_exception_destroy __std_exception_copy __std_terminate strrchr wcschr memcmp __current_exception __current_exception_context __intrinsic_setjmp _purecall memcpy

api-ms-win-crt-stdio-l1-1-0

_set_fmode _pclose _popen fflush _wfopen fseek ftell __p__commode getchar _read _write __stdio_common_vfprintf __stdio_common_vswprintf _fileno _close __acrt_iob_func fgets feof fopen_s ferror _lseeki64 setvbuf _wopen fsetpos _fseeki64 __stdio_common_vsprintf_s fputs __stdio_common_vsprintf fgetc fgetpos fwrite fread ungetc fputc __stdio_common_vsscanf _get_stream_buffer_pointers fclose

api-ms-win-crt-runtime-l1-1-0

_beginthreadex _errno _resetstkoflw _invalid_parameter_noinfo __sys_errlist abort __sys_nerr terminate exit system _invoke_watson _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _exit _get_initial_narrow_environment _initterm _initterm_e

api-ms-win-crt-convert-l1-1-0

strtod strtoull strtoul strtol strtoll wcstombs atof strtof atoi

api-ms-win-crt-filesystem-l1-1-0

_unlink _wstat64 remove _unlock_file _lock_file _fstat64

api-ms-win-crt-locale-l1-1-0

___lc_locale_name_func localeconv ___lc_collate_cp_func ___lc_codepage_func _configthreadlocale

api-ms-win-crt-math-l1-1-0

floorf floor fmodf _dsign log ldexp round modf frexp roundf log2 acos exp lroundf pow powf sin sinf sinh sqrt sqrtf tan tanf lround ceil asin fmod asinf ceilf _fdopen cos atan atan2 cosf __setusermatherr atan2f atanf logf _dclass expf log10 cosh acosf tanh

api-ms-win-crt-heap-l1-1-0

calloc malloc _callnewh realloc _set_new_mode free

api-ms-win-crt-time-l1-1-0

_time64 _localtime64_s _localtime64 _gmtime64 clock strftime _gmtime64_s _difftime64

api-ms-win-crt-string-l1-1-0

wcsncmp wcspbrk tolower strncpy strncmp strlen _strnicmp _strdup wcscpy_s isalnum wcslen iswspace islower ispunct iscntrl isspace isdigit isxdigit _wcsicmp _stricmp isalpha isupper isgraph strpbrk strcpy_s _wcsnicmp wcsncpy towlower strncat strcmp _wcsdup strcspn toupper isblank strspn

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList InitializeSListHead

oleaut32

SetErrorInfo SysFreeString GetErrorInfo SysStringLen

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory