Static task
static1
Behavioral task
behavioral1
Sample
sha256sum.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
sha256sum.exe
Resource
win10v2004-20230220-en
General
-
Target
sha256sum.exe
-
Size
71KB
-
MD5
b11676fd26fdd0daa42dff371f86ed8f
-
SHA1
394eb973190f9358ddcf4e4bf1cb046437152f62
-
SHA256
4867ccab1c36f33dec005e83eef8dfb6d3b166941a72400aa3c963675c2a7dae
-
SHA512
f3be334d670b279a86fd8e1b2c691c153da5dd43e19947ab8becc76f7271ade26fc5a334342c0067307da568d55bc65165620127e4c2d56aaafadb1eef5534c2
-
SSDEEP
1536:jpYFnmuqbPfl+RyADAm+Cpvg5sf9DmynY5NKdyQs8YM3i1zw4xWl/rsZl1PS:9YFnmll+RyADAmt260ynY5Nqs8hlQZfq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource sha256sum.exe
Files
-
sha256sum.exe.exe windows x86
e6d26ee9e3f1f847212ca82b160a1580
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
AddAtomA
ExitProcess
FindAtomA
GetAtomNameA
GetFileAttributesA
GetFileType
GetLastError
IsDBCSLeadByteEx
MultiByteToWideChar
SetUnhandledExceptionFilter
msvcrt
_chdir
_close
_dup
_dup2
_fdopen
_fstat
_isatty
_lseek
_open
_stat
_strdup
__getmainargs
__lc_codepage
__mb_cur_max
__p__environ
__p__fmode
__set_app_type
_assert
_cexit
_errno
_exit
_filbuf
_findclose
_findfirst
_findnext
_flsbuf
_fullpath
_get_osfhandle
_iob
_isctype
_onexit
_pctype
_setmode
_snprintf
abort
atexit
calloc
exit
fclose
fflush
fopen
fprintf
fread
free
freopen
ftell
fwrite
getenv
iswctype
malloc
memcpy
memmove
memset
printf
realloc
setlocale
signal
sprintf
strchr
strcmp
strcpy
strerror
strlen
strncmp
strrchr
tolower
Sections
.text Size: 62KB - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 864B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE