calamari[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
calamari.exe
Size 4.3MB
Sample261011-zf2ddsgf92
SHA256 5aa1a8f06cf954f8579c1ffd0a6060c77f17a68f4e6b919183ab5ed220113cbc
MD5 8c558c8e7ef96195cbf9dbd8443dc2c6
SHA1 0709d4cfb2bcb31d6d63e16eb8155ffab1bee082
SHA512 cf09c9ed01ad07fa134d50db0b9a78093dc86832ad917a6bb3ff244c8dae78e6be24710de4804de933f146f90101044a3a8588adf1b505f55d952a9a1cb2c500
SSDEEP 49152:fRN0gVDWIZ3XDQTB4d73WNiF6wRWjxPdEZ1NRXH5mYSWOy4VyAmY72yRekrpw:fyQ3zy4djWNi8wRWjxPdomYdQVyAE
TLSH
T16526C003B743A66EC5E3C4754347FA071EC1F8865739BADB91819E2569352E00F3EBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
calamari.exe

File Explorer

calamari.exe

.exe 4.3MB

calamari.exe

IMPHASH af572e901f86b3c7b0ce35d81da6f8b0
SHA256 5aa1a8f06cf954f8579c1ffd0a6060c77f17a68f4e6b919183ab5ed220113cbc
MD5 8c558c8e7ef96195cbf9dbd8443dc2c6
SHA1 0709d4cfb2bcb31d6d63e16eb8155ffab1bee082
SHA512 cf09c9ed01ad07fa134d50db0b9a78093dc86832ad917a6bb3ff244c8dae78e6be24710de4804de933f146f90101044a3a8588adf1b505f55d952a9a1cb2c500
SSDEEP 49152:fRN0gVDWIZ3XDQTB4d73WNiF6wRWjxPdEZ1NRXH5mYSWOy4VyAmY72yRekrpw:fyQ3zy4djWNi8wRWjxPdomYdQVyAE
TLSH
T16526C003B743A66EC5E3C4754347FA071EC1F8865739BADB91819E2569352E00F3EBA8
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1294000

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\sxxw\Desktop\fortnite\Calamari-Fortnite-main\calamari-executor\..\calamari-bootstrap\testing\calamari.pdb

kernel32

AcquireSRWLockExclusive AreFileApisANSI CloseHandle CompareStringW CreateDirectoryW CreateFileW CreateThread CreateToolhelp32Snapshot DecodePointer DefineDosDeviceW DeleteCriticalSection DeleteFileW DeviceIoControl EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetConsoleWindow GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableA GetExitCodeThread GetFileAttributesExW GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocaleInfoEx GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetPrivateProfileStringA GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetTempPathW GetTickCount GetTickCount64 GetUserDefaultLCID GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LocalFree Module32FirstW MultiByteToWideChar OpenProcess Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReadProcessMemory ReleaseSRWLockExclusive SetConsoleTextAttribute SetConsoleTitleA SetCurrentConsoleFontEx SetEndOfFile SetEnvironmentVariableW SetEvent SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter VirtualAlloc VirtualFree VirtualProtect WaitForSingleObjectEx WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WritePrivateProfileStringA WriteProcessMemory

user32

ClientToScreen CloseClipboard DispatchMessageW EmptyClipboard EnableWindow EnumWindows FillRect GetAsyncKeyState GetClassNameA GetClientRect GetClipboardData GetCursorPos GetDC GetForegroundWindow GetKeyState GetWindowRect GetWindowTextA GetWindowThreadProcessId LoadCursorW MessageBoxA MessageBoxW MoveWindow OpenClipboard PeekMessageA ReleaseDC ScreenToClient SetClipboardData SetCursor SetCursorPos SetWindowLongA SetWindowPos ShowWindow TranslateMessage UpdateWindow

gdi32

CreateSolidBrush DeleteObject

dwmapi

DwmExtendFrameIntoClientArea

d3d9

Direct3DCreate9

ntdll

NtLoadDriver NtQueryInformationProcess NtQuerySystemInformation NtUnloadDriver RtlAdjustPrivilege RtlCaptureContext RtlInitUnicodeString RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind

advapi32

CloseServiceHandle ControlService CreateServiceW DeleteService GetTokenInformation OpenProcessToken OpenSCManagerW RegCloseKey RegCreateKeyW RegDeleteTreeW RegEnumKeyExW RegGetValueW RegOpenKeyExW RegOpenKeyW RegSetKeyValueW StartServiceW

d3dx9_43

D3DXCreateTextureFromFileInMemoryEx

imm32

ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

329KB

Virtual Size

328KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2.5MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.retplne

Size

512B

Virtual Size

200B

Characteristics

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

432B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

calamari.exe

kernel32

user32

gdi32

dwmapi

d3d9

ntdll

advapi32

d3dx9_43

imm32

generic