Static task
static1
Behavioral task
behavioral1
Sample
Heist Editor3.5.10.exe
Resource
win10-20230220-en
General
-
Target
Heist Editor3.5.10.exe
-
Size
17.0MB
-
MD5
6a949faf98c90349e2eb722d9862ff92
-
SHA1
372846d9786b12ac78c605dabee4317e7c369255
-
SHA256
9b01173dd14d401e4147d619e3d1a104eb0ef41008c6632c9835aabd3f3f955e
-
SHA512
097723d9ed2793a4ae25895f15ba1b549484c594e7a1ef9d2120a3f7ddd9f1fab68651b6f9ce7e3f72700a5b4f8a7059437af1852cb59313a25fd23affadc3a2
-
SSDEEP
196608:fDuzt1EWOSaCHVhdq+RGLoj2AYP3Vi9sNe+YED0MAGvAlQemqEzbcY9G3c87Mrik:fDuzrVjxGABo1e+YMpZePwJSdVjmAi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Heist Editor3.5.10.exe
Files
-
Heist Editor3.5.10.exe.exe windows x64
07ba3ae9851da78b891c505aa6f4be5c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetVersionExW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
IsZoomed
CharUpperBuffW
gdi32
Escape
msimg32
TransparentBlt
winspool.drv
ClosePrinter
advapi32
RegSetValueExW
shell32
SHGetMalloc
comctl32
InitCommonControlsEx
shlwapi
PathFindFileNameW
uxtheme
GetThemePartSize
ole32
CoInitializeEx
oleaut32
LoadTypeLi
oledlg
OleUIBusyW
gdiplus
GdipCreateFromHDC
oleacc
LresultFromObject
imm32
ImmReleaseContext
winmm
PlaySoundW
Sections
.text Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 630KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.&<> Size: - Virtual size: 9.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.MNj Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.n*~ Size: 12.8MB - Virtual size: 12.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4.1MB - Virtual size: 4.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ