CometCursor-v1.3.2-win-x64.zip
- SHA256 56a21f8b601a13a5350a4a11af257523db0a2d316d1ef3e4f094c92b8ee6129b
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CometCursor.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
CometCursor.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
CometCursor.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
CometCursor.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target CometCursor-v1.3.2-win-x64.zip
- Size 112KB
- Sample261027-p2jelatye1
- SHA256 56a21f8b601a13a5350a4a11af257523db0a2d316d1ef3e4f094c92b8ee6129b
- MD5 ec5dcc6c2f23ce08617fabb2a668e7ce
- SHA1 879fbe5deb9ad75156e7802cd8edb6d7bd2e8db3
- SHA512 1d0bb51a421dc6682c6323fa6fac6e0967dfb1e09a54911d17e137d6bb4127be49123609bfc7054f270335704075aad451ac18e941e22c0dcc4432f4d33a4ec3
- SSDEEP 1536:wXKLBq+jNcnxN9Jjl7Mj/F9E9v1TcDTK6kM6DlEJqA94olVdKXH5pvXxdZAa:wKI2cxN95lmwODu6eF64oljKXHv
- TLSH T119B312B1E86EAA08F9392668049F935B37F7A25F450A217B190275E0EAD223DE0527D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/CometCursor.dll unpack001/CometCursor.exe
File Explorer
-
CometCursor-v1.3.2-win-x64.zip.zip 112KB
-
CometCursor.deps.json478B
-
CometCursor.dll.exe 67KB
-
CometCursor.exe.exe 148KB
-
CometCursor.pdb32KB
-
CometCursor.runtimeconfig.json429B
CometCursor.deps.json
- SHA256 16037429d8284666e07bca1b82fd745f0d90ec44ea3f079e78ee9135541d915a
- MD5 7feceb310b732a489ac9db1988f3e483
- SHA1 2677b2069c030eac3ce710497b8d61ef58f3314c
- SHA512 80e491a38a1bceacbd23e69c6c54fd2e01a482cae7f7eaa29393a997c71e78f11e02ab2bb345edeb0379a17b0d7ae81a5c5dc58086b3acdc7d81031a75402b39
- TLSH T170F0A009E5840D9705F123B9643A4763F9B297330826280A7ABEC46C4FF28774010E7C
- MD5 SHA1 SHA512 TLSH
CometCursor.dll
- SHA256 af587df671f15dadc89e79242cf2a72cbb0e182ff84cc1aa3a484f9eb369442d
- MD5 cd3d6f22fb59128c8c98590b7006afdc
- SHA1 18c8cd3175bf4f26f48553f395af1dd78d714f32
- SHA512 14719304cac6bd88c7ab3c3ae38350813f6affa3f31b637419e121037fd6c10c2924e50a168ec383d5824d5c13e6096a026c01c6f3d8ba448852a0e85dd00355
- SSDEEP 1536:HNg+eTfHsa086c1WgVGQ/QuJRAwM1btaxETIDm:H++sflb7iYabt4c
- TLSH T105636C51B2BCCA2BC4BE8AB95191968103FAD2532313FB980EC7F5FE16167D626053C7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
c:\Users\Usergate\Documents\antigravity\fervent-hubble\CometCursor\src\CometCursor\obj\Release\net8.0-windows\win-x64\CometCursor.pdb
Name
.text
Size
64KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
CometCursor.exe
- IMPHASH bb3ac2c21e02c68abcad237dc3fa6d00
- SHA256 87c1adff0c74222bb58f0cd754281787b754bd82026af32489000261a8eccfcf
- MD5 1945214e0618943e2c64a2fcc0f24320
- SHA1 bb24c303388d86077d468cfbb7cd55d18283b54b
- SHA512 0b9658e50d00c1dc14c8d8436037621eb63f71bc7fc62f00b95e50c5664f4403be59c5cc9dd15a556de507611aee9f8e39484268685653811f1b2befedf78594
- SSDEEP 3072:XqeXA/4yIbHkNPN+6H6xCYOiVUE265MJh:XvdHkNFdaxmVEsJ
- TLSH T135E33B07A2A851BDE1B7D679CD924D41FB7378598B71A6CF03504AB60E73BD0AE39302
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
72400
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_invoke_watson
__p___argc
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_errno
_initialize_onexit_table
abort
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___wargv
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
_set_fmode
fputwc
__p__commode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
wcsncmp
toupper
strcmp
strlen
_wcsdup
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
wcsftime
_gmtime64_s
_time64
api-ms-win-crt-locale-l1-1-0
___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
setlocale
_unlock_locales
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
89KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=12, id=260, version=35207,
count=87, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33145,
count=204, id=1, productName=Unmarked objects,
count=10, id=265, version=35228,
count=1, id=258, version=35228,
CometCursor.pdb
- SHA256 8e5a23be42ad29f7f73bedf5e3ecec6d9af73134aa9617b35d79fed58235b67d
- MD5 f4527b7df0be402d3002f0c831aafa40
- SHA1 4729362f4852917d9eb6b3f632884048bda2f44d
- SHA512 e2d61799c40cd2cd9ce2f4f045d6d826d95173036e594bfe3360edb574dc54072e7d2873c69f37cf5419a4633cf25226a2e7728eb29eb0880484f74615aed1ad
- SSDEEP 384:4rqKBjs/zd+Ht4gCvWNE7ypgX+g8rFSICDShiYHrBBTRe1cXazalqCjEqZ6FBMHa:Dp+G/ShiGnANpzQoVbpaFyg9O9XM4F
- TLSH T18FE2D42BD388CE24C9561A768472C29A7338D314A70ADF77B2D8733ADD9F75803B2165
- MD5 SHA1 SHA512 SSDEEP TLSH
CometCursor.runtimeconfig.json
- SHA256 73b37384bb001e78db2014d328750eb2990393712fd63cd00c0f41965b3dbe96
- MD5 1043e1e5e960609d014e56f638202c24
- SHA1 aaa1583e8c9809a39a52c73efff1e5e439cfd3df
- SHA512 5fe61affcddd7b6235270cc3f0e7fa7f2e890852de6f5c7759234870d244ee1b32f95dfd7efb5e2f410d12557593491c53a5323b68966918f92a545c1f10d66e
- TLSH T1BEE02A3ACA206DB714F02BBEC02AC187FA3023AB00040D16BAFC180C2F361A22001F88
- MD5 SHA1 SHA512 TLSH