Static task
static1
Behavioral task
behavioral1
Sample
CVE-2020-0787.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
CVE-2020-0787.exe
Resource
win10v2004-20230703-en
General
-
Target
CVE-2020-0787.exe
-
Size
166KB
-
MD5
ad07dac5a338dbd6ccd2bed825179843
-
SHA1
b558da0fc79c8750dee858da03d06a1399d838dc
-
SHA256
cee3c765539c5e90ffa552cdc2cc62d05c8c02c009d58cc8c2d78c0bc892f801
-
SHA512
7e5d82bd2f375a4b2b5f950fe15f625ea8a95e9a97b3ddbb34f658f54af3d794d81555e7a077810765a8416e527f5e627d4ada16cc7b5a52a576dabf65c41d9a
-
SSDEEP
3072:OU+phcNuWx9LWLqINvQTMS0GcUF+8shDvdgmZvvG0bXn:vNFx9LWLqIK4ZGcUYlHvpD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource CVE-2020-0787.exe
Files
-
CVE-2020-0787.exe.exe windows x86
182930400536ba8aedd68d86a08a3a5d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameW
InitializeCriticalSectionEx
LocalAlloc
CreateFileW
CreateEventW
ProcessIdToSessionId
FormatMessageW
Wow64RevertWow64FsRedirection
GetLastError
SetEvent
DeleteFileW
Wow64DisableWow64FsRedirection
RaiseException
DecodePointer
LocalFree
GetFileSize
DeleteCriticalSection
GetCurrentProcessId
CopyFileW
IsWow64Process
WriteFile
GetCurrentProcess
FindNextFileW
FindFirstFileW
CloseHandle
GetOverlappedResult
WaitForSingleObject
DeviceIoControl
CreateThreadpoolWait
CloseThreadpoolWait
SetThreadpoolWait
WriteConsoleW
SetFilePointerEx
GetStringTypeW
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExW
FindClose
HeapReAlloc
HeapSize
CreateDirectoryW
SetConsoleTextAttribute
GetStdHandle
RemoveDirectoryW
GetTempPathW
GetFileAttributesW
Sleep
MultiByteToWideChar
WideCharToMultiByte
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess
RtlUnwind
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetACP
HeapFree
HeapAlloc
GetFileType
CompareStringW
LCMapStringW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
advapi32
SetTokenInformation
OpenProcessToken
CreateProcessAsUserW
DuplicateTokenEx
shell32
ShellExecuteW
ole32
CoMarshalInterface
CreateILockBytesOnHGlobal
CreateStreamOnHGlobal
StringFromIID
StgCreateDocfileOnILockBytes
CoCreateGuid
CoCreateInstance
CoUninitialize
CoInitialize
CLSIDFromString
CoGetStdMarshalEx
CoTaskMemFree
CoInitializeEx
StringFromCLSID
oleaut32
LoadTypeLi
VariantClear
CreateTypeLib2
SysAllocStringByteLen
SysAllocString
SysStringLen
SysFreeString
shlwapi
PathRemoveFileSpecW
PathIsDirectoryW
PathFindFileNameW
Sections
.text Size: 115KB - Virtual size: 115KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ