Static task
static1
Behavioral task
behavioral1
Sample
help.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
help.exe
Resource
win10v2004-20230220-en
General
-
Target
help.exe
-
Size
10KB
-
MD5
f97c660210957143d867c6ff80f14014
-
SHA1
76831169eb902eb013c0a69ff5c2363b9708277a
-
SHA256
8da3448c06940e6c3ce00784f2aed5bcf9ccc3a0479cc6ff047e5b03b43c406b
-
SHA512
3706cd8af2a00356d6980cc8ad116b60670ae6269c981346b0bf83021f62c43d2e65f5ae6e334b42d0dbbb67e210e553e5a20bf075747742b1935aeca72ae9a7
-
SSDEEP
96:vBWoDmP+QOikMsR2BWhFDWzshs+ztGSR1c0fWbgdWiDJvkMhd0cmEWUcWw0xt8vp:JJQNOFFG+Xj1fWbgdWekkWUcW3G
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource help.exe
Files
-
help.exe.exe windows x86
611805a7c3221ebb521e87bf9182d982
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetConsoleOutputCP
GetStdHandle
WriteFile
SetThreadUILanguage
GetConsoleMode
FormatMessageW
HeapSetInformation
WriteConsoleW
LocalFree
WideCharToMultiByte
GetFileType
GetCurrentProcess
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
Sleep
TerminateProcess
msvcrt
__wgetmainargs
__set_app_type
__p__commode
_exit
_cexit
__p__fmode
__setusermatherr
_initterm
?terminate@@YAXXZ
_controlfp
_except_handler4_common
_amsg_exit
_XcptFilter
malloc
_wcsnicmp
free
_wsystem
wcscat_s
wcscpy_s
_ultow
setlocale
exit
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 960B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 376B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ