selkie_core[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
selkie_core.exe
Size 2.4MB
Sample261006-xerrfssw9j
SHA256 4742d7664c0c6fd1b1fddc60807f7b5ae8875d09d87ecf2907a0a980ecad0bae
MD5 365e690724a577c6f284f19b37c264e5
SHA1 0589d5a455aff1392c2756c99e2146371e789ebc
SHA512 90cf6d0ea7f9a85981be96bb1363b94a22434421ce9b771ef08a394855e0671a7e4198c410f8753607d7241977690c189842f849347f2eca78469f83ed1ca399
SSDEEP 24576:uNxm0HaG1zz5pYQC1VF5rR1HP+vtwrIKPZT8mh0lhSMXlJ62HUsC79:uTPHaGtzNC1VFJHPWyI28TZ+l7
TLSH
T1C6C5AE16B2A501F9C07BC0B8CA579617F7B2744A03349AEF33E49A691F235E15E3BB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
selkie_core.exe

File Explorer

selkie_core.exe

.exe 2.4MB

selkie_core.exe

IMPHASH 2b5d2103ffc92083a820163e0ca7e487
SHA256 4742d7664c0c6fd1b1fddc60807f7b5ae8875d09d87ecf2907a0a980ecad0bae
MD5 365e690724a577c6f284f19b37c264e5
SHA1 0589d5a455aff1392c2756c99e2146371e789ebc
SHA512 90cf6d0ea7f9a85981be96bb1363b94a22434421ce9b771ef08a394855e0671a7e4198c410f8753607d7241977690c189842f849347f2eca78469f83ed1ca399
SSDEEP 24576:uNxm0HaG1zz5pYQC1VF5rR1HP+vtwrIKPZT8mh0lhSMXlJ62HUsC79:uTPHaGtzNC1VFJHPWyI28TZ+l7
TLSH
T1C6C5AE16B2A501F9C07BC0B8CA579617F7B2744A03349AEF33E49A691F235E15E3BB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

932576

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Ridhwan\Desktop\selkie-client-osu\builds\x64\Release\selkie_app.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll

kernel32

WideCharToMultiByte ReadFile GetFileSizeEx GetCurrentProcess WriteFile CreateMutexW WaitForSingleObject GetFileAttributesW ReleaseMutex GetFileInformationByHandle LCMapStringEx SetFileInformationByHandle DeleteFileW MoveFileExW GetSystemTimeAsFileTime FlushFileBuffers GetModuleHandleW GetModuleFileNameW SetEndOfFile GetCurrentThreadId CancelSynchronousIo SetFilePointerEx SetThreadPriority GetCurrentThread GetProcAddress LoadLibraryExW SetWaitableTimer WaitForMultipleObjects CreateEventW SetEvent CreateWaitableTimerExW VirtualQueryEx IsWow64Process IsWow64Process2 HeapFree GetModuleHandleExW GetSystemDirectoryW K32GetModuleInformation HeapAlloc GetProcessHeap VirtualQuery FindFirstFileExW FindNextFileW FindClose GetFileAttributesExW QueryPerformanceCounter GlobalAlloc GlobalFree GlobalLock GlobalUnlock ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW FormatMessageA GetLocaleInfoEx QueryPerformanceFrequency GetSystemTimePreciseAsFileTime ReleaseSRWLockShared AcquireSRWLockShared TryAcquireSRWLockExclusive Sleep WaitForSingleObjectEx SwitchToThread GetExitCodeThread WakeConditionVariable GetCurrentDirectoryW CreateDirectoryW FindFirstFileW GetFullPathNameW CreateFile2 AreFileApisANSI SetLastError GetFileInformationByHandleEx RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer GetStringTypeW GetCPInfo RtlLookupFunctionEntry RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStdHandle ExitProcess VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetProcessTimes IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetConsoleOutputCP GetConsoleMode ReadConsoleW GetTimeZoneInformation OutputDebugStringW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle HeapReAlloc HeapSize WriteConsoleW GetCurrentProcessId FindResourceW OutputDebugStringA LoadLibraryW GetEnvironmentVariableW RtlUnwind GetTickCount64 GetBinaryTypeW GetFinalPathNameByHandleW GetProcessId CompareStringOrdinal CreateFileW OpenProcess CreateToolhelp32Snapshot GetLastError Process32NextW Process32FirstW CloseHandle LocalFree CreateProcessW MultiByteToWideChar LoadResource LockResource SizeofResource GetExitCodeProcess QueryFullProcessImageNameW GetLocaleInfoW

user32

SystemParametersInfoW IsZoomed SetCursor GetPointerInfo SetCapture SetFocus GetSysColor TrackMouseEvent MapWindowPoints IsChild GetMonitorInfoW GetCapture OffsetRect WindowFromPoint GetPointerPenInfo SendMessageW ScreenToClient UnionRect FillRect SetWindowRgn AdjustWindowRectExForDpi MonitorFromWindow GetDpiForWindow GetPointerDeviceRects EqualRect SetWindowPos InflateRect GetWindowRect ReleaseCapture DefWindowProcW PostMessageW DestroyWindow IsWindowVisible SetWindowLongPtrW GetPointerTouchInfo UnregisterClassW CreatePopupMenu GetWindowLongPtrW RegisterClassExW TrackPopupMenu ShowWindow DispatchMessageW DestroyMenu TranslateMessage ChangeWindowMessageFilterEx AppendMenuW PostQuitMessage RegisterWindowMessageW InvalidateRect GetWindowRgn OpenClipboard CloseClipboard EmptyClipboard SetClipboardData CallNextHookEx GetWindowThreadProcessId ClientToScreen SetForegroundWindow LoadImageW IsIconic GetSystemMetrics GetCursorPos SetTimer KillTimer IsWindow MessageBoxW GetForegroundWindow EnumWindows GetClassNameW GetClientRect CreateWindowExW RegisterPointerInputTarget GetAncestor GetWindowTextW PeekMessageW UnhookWindowsHookEx PostThreadMessageW SetWindowsHookExW SendInput MonitorFromPoint GetMessageW

gdi32

CreateRectRgn EqualRgn DeleteObject CombineRgn CreateSolidBrush

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW EventUnregister RegGetValueW EventRegister EventSetInformation GetTokenInformation CredWriteW SetFileSecurityW CredReadW CredFree OpenProcessToken ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW EventWriteTransfer

shell32

CommandLineToArgvW Shell_NotifyIconW ShellExecuteExW SHOpenWithDialog ShellExecuteW SHGetFolderPathW Shell_NotifyIconGetRect SHGetKnownFolderPath

ole32

CoInitializeEx CoTaskMemAlloc CoCreateInstance CoTaskMemFree CoUninitialize

dcomp

DCompositionCreateDevice

d3d11

D3D11CreateDevice

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

uiautomationcore

UiaReturnRawElementProvider

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

shlwapi

ord12

bcrypt

BCryptDestroyKey BCryptGetProperty BCryptOpenAlgorithmProvider BCryptHash BCryptGenerateSymmetricKey BCryptCreateHash BCryptSetProperty BCryptHashData BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptGenRandom BCryptEncrypt BCryptFinishHash BCryptDecrypt

crypt32

CryptBinaryToStringW CertVerifyCertificateChainPolicy

wintrust

CryptCATAdminEnumCatalogFromHash CryptCATCatalogInfoFromContext CryptCATAdminAcquireContext2 CryptCATAdminCalcHashFromFileHandle2 WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData WinVerifyTrust CryptCATAdminReleaseCatalogContext CryptCATAdminReleaseContext

winmm

timeEndPeriod timeBeginPeriod

mfplat

MFShutdown MFCreateWaveFormatExFromMFMediaType MFCreateMediaType MFCreateMFByteStreamOnStream MFStartup

mfreadwrite

MFCreateSourceReaderFromByteStream

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

530KB

Virtual Size

530KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

51KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

58KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

200KB

Virtual Size

199KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

selkie_core.exe

api-ms-win-core-synch-l1-2-0

kernel32

user32

gdi32

advapi32

shell32

ole32

dcomp

d3d11

dwmapi

uiautomationcore

version

shlwapi

bcrypt

crypt32

wintrust

winmm

mfplat

mfreadwrite

generic