Static task
static1
Behavioral task
behavioral1
Sample
Heist Editor.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
Heist Editor.exe
Resource
win10v2004-20230621-en
General
-
Target
Heist Editor.exe
-
Size
30.9MB
-
MD5
d4c0321182b3ae326beb85aa1ac74388
-
SHA1
20ffbc22836b5b5e9ac2b187abb8b17322add5c4
-
SHA256
f8c2d4e29abfccef05e819e7f6b6fa80b447803a5d9ec914204074118f37aee1
-
SHA512
1ee83a4fa62c2ef0b721b3a1829803425f78c2292a527adb46a96116245c49a2570e0f7866d37d7e5904400b9ec59a4cd1eafd33ce6e18783ba6c7eab3d99b5b
-
SSDEEP
786432:+4DVfCyT8B0CiryFQgAt7X2jTiwZZPoSxi:+iVA7irBt7X2/ZZAS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Heist Editor.exe
Files
-
Heist Editor.exe.exe windows x64
f439712d95964b68fcda9634ba965a39
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetVersionExW
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
IsZoomed
CharUpperBuffW
gdi32
Escape
msimg32
TransparentBlt
winspool.drv
ClosePrinter
advapi32
RegSetValueExW
shell32
SHGetMalloc
comctl32
InitCommonControlsEx
shlwapi
PathFindFileNameW
uxtheme
GetThemePartSize
ole32
CoInitializeEx
oleaut32
LoadTypeLi
oledlg
OleUIBusyW
gdiplus
GdipCreateFromHDC
oleacc
LresultFromObject
imm32
ImmReleaseContext
winmm
PlaySoundW
Sections
.text Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 630KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.5Cg Size: - Virtual size: 18.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.7%F Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.<] Size: 26.8MB - Virtual size: 26.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4.1MB - Virtual size: 4.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ