Static task
static1
Behavioral task
behavioral1
Sample
HEUR-Trojan.Win32.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
HEUR-Trojan.Win32.exe
Resource
win10v2004-20230220-en
General
-
Target
HEUR-Trojan.Win32.Generic-c8e567bcb80b60d315de1845f9faf89094d7ca33801b1662c8e8d8be11de6100
-
Size
46KB
-
MD5
baf62438109b097fbcaacc66ae09734c
-
SHA1
1548ce00fa365670a40ded8ffe6e001b52f8a77b
-
SHA256
c8e567bcb80b60d315de1845f9faf89094d7ca33801b1662c8e8d8be11de6100
-
SHA512
f3bc64725037049874bf812acefe10971b0225434b64d20dbc7c62eae214e3b79f8ae71645509f7d9da5139172b6001114adfd685a97abbc020c924b3e0ce999
-
SSDEEP
768:veW02gal8GgXD04RRkVE4yH0j3jWP0sVU8W4QnL/TFZBO:zVgaGA4RRvpQ3jWPfVHW4Q9u
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource HEUR-Trojan.Win32.Generic-c8e567bcb80b60d315de1845f9faf89094d7ca33801b1662c8e8d8be11de6100
Files
-
HEUR-Trojan.Win32.Generic-c8e567bcb80b60d315de1845f9faf89094d7ca33801b1662c8e8d8be11de6100.exe windows x86
549976dd4ec7f4eda0e096db6476ab4f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
memset
strncpy
strlen
strcpy
strcat
memcpy
kernel32
GetModuleHandleA
HeapCreate
VirtualProtect
VirtualUnlock
HeapDestroy
ExitProcess
FreeEnvironmentStringsA
SetUnhandledExceptionFilter
SetProcessWorkingSetSize
HeapLock
LoadLibraryA
GetProcAddress
FreeLibrary
HeapFree
HeapAlloc
CloseHandle
CreateFileA
SetFilePointer
SetEndOfFile
WriteFile
GlobalLock
GlobalUnlock
HeapReAlloc
GetLogicalDriveStringsA
user32
GetSysColor
SystemParametersInfoA
LoadMenuA
WindowFromDC
DdeImpersonateClient
GetMenuItemCount
DdeDisconnectList
UnhookWindowsHookEx
ClipCursor
GetKBCodePage
RemoveMenu
SetWindowTextA
MsgWaitForMultipleObjects
CheckMenuItem
OpenClipboard
GetClipboardData
CloseClipboard
comdlg32
PrintDlgA
advapi32
SetThreadToken
comctl32
InitCommonControlsEx
ole32
CoInitialize
winmm
waveOutMessage
DefDriverProc
midiDisconnect
waveInGetErrorTextA
mciSendCommandA
shell32
DragQueryFileA
version
VerInstallFileA
Sections
.code Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ