curl_x64[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
curl_x64.exe
Size 2.1MB
Sample261102-rx4k3sfd54
SHA256 9c500cfe5fec24ea0cd06e18b1034dc3809233954976d3a29937d4719d139d27
MD5 29380596a1c8d726778b7ba4dd79c51c
SHA1 d3a0eff8cab903e34533d16da5c3d31255523a0f
SHA512 a38bc4e8b705df5cc39c0a3b14f8fcaa34062d66d0c655d111d6c48ec8548134f628bef0019a27d5e19386e64fd435f08ac76756259013979473c85c825fb128
SSDEEP 49152:LOZlkFAfRboqtjUQzGKf4sKH14Ttmpzl1:mWOfqXOql
TLSH
T164A55B13FAD024E5CEEAC13488625EA7E7F0759403A1A7DB8F9089E91F179E51F3D260
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
curl_x64.exe

File Explorer

curl_x64.exe

.exe 2.1MB

curl_x64.exe

IMPHASH 8393b318c674d5995de4e979ead82196
SHA256 9c500cfe5fec24ea0cd06e18b1034dc3809233954976d3a29937d4719d139d27
MD5 29380596a1c8d726778b7ba4dd79c51c
SHA1 d3a0eff8cab903e34533d16da5c3d31255523a0f
SHA512 a38bc4e8b705df5cc39c0a3b14f8fcaa34062d66d0c655d111d6c48ec8548134f628bef0019a27d5e19386e64fd435f08ac76756259013979473c85c825fb128
SSDEEP 49152:LOZlkFAfRboqtjUQzGKf4sKH14Ttmpzl1:mWOfqXOql
TLSH
T164A55B13FAD024E5CEEAC13488625EA7E7F0759403A1A7DB8F9089E91F179E51F3D260
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1239928

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\peter\Documents\GitHub\curl-for-windows\out\x64\Release\curl.x64.pdb

kernel32

EnterCriticalSection DeleteCriticalSection FreeLibrary GetProcAddress LoadLibraryA PeekNamedPipe ReadFile GetStdHandle GetFileType WaitForMultipleObjects WaitForSingleObjectEx CloseHandle MultiByteToWideChar GetModuleHandleA GetCurrentThreadId GetVersion WideCharToMultiByte FindClose GlobalMemoryStatus QueryPerformanceCounter GetTickCount GetVersionExA GetCurrentProcessId FlushConsoleInputBuffer MapViewOfFile UnmapViewOfFile CreateFileMappingA HeapFree HeapReAlloc HeapAlloc IsDebuggerPresent IsProcessorFeaturePresent SetFilePointerEx SetStdHandle GetSystemTimeAsFileTime LocalFileTimeToFileTime SetFileTime SystemTimeToFileTime FileTimeToLocalFileTime GetFileInformationByHandle FileTimeToSystemTime GetCommandLineA EncodePointer DecodePointer CreateThread ExitThread LoadLibraryExW SetConsoleCtrlHandler ExitProcess GetModuleHandleExW AreFileApisANSI GetTimeZoneInformation GetConsoleMode InitializeCriticalSectionEx ReadConsoleInputA SetConsoleMode GetModuleFileNameW WriteConsoleW IsValidCodePage GetACP GetOEMCP GetCPInfo GetProcessHeap RtlUnwindEx GetStartupInfoW ReadConsoleW WriteFile GetConsoleCP RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW FlushFileBuffers FindFirstFileExW GetDriveTypeW SystemTimeToTzSpecificLocalTime GetEnvironmentStringsW FreeEnvironmentStringsW CreateFileW GetFileAttributesExW OutputDebugStringW GetStringTypeW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW CompareStringW LCMapStringW GetFullPathNameW GetCurrentDirectoryW SetEnvironmentVariableA HeapSize LeaveCriticalSection VerifyVersionInfoA SleepEx VerSetConditionMask FormatMessageA SetLastError GetModuleFileNameA SearchPathA GetTickCount64 ExpandEnvironmentStringsA GetEnvironmentVariableA SetEndOfFile Sleep GetLastError CreateDirectoryW

ws2_32

shutdown gethostname ntohl htonl getaddrinfo freeaddrinfo listen htons ntohs getsockname setsockopt bind socket WSASetLastError closesocket getsockopt WSAGetLastError recv send ioctlsocket WSAStartup WSACleanup accept recvfrom sendto select __WSAFDIsSet getpeername WSAIoctl connect

wldap32

ord46 ord211 ord301 ord27 ord33 ord79 ord30 ord200 ord32 ord35 ord22 ord50 ord143 ord41 ord26 ord60

advapi32

RegisterEventSourceA ReportEventA DeregisterEventSource

user32

SendMessageA FindWindowA GetProcessWindowStation MessageBoxA GetDesktopWindow GetUserObjectInformationW