Heimdall[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Heimdall.exe
Size

159KB
MD5

73c296956bb68b74eafadfb5f974cf1b
SHA1

daa9bb537a1a9e48e762ab9104111419b972b206
SHA256

9b0cef5e9ce21bcefd9170008cdc72b646c40dc1c495169371cf890e792bebb5
SHA512

a90461e326a05e29f36c8e6ab5cf2050737a20bcd91ce64ede9aa7a6195547e5467dbb08daedff7e93b2b5514a0e1f146d1015f64afd93da39e6c7bd380b2d47
SSDEEP

3072:0VU/LoNUmdIJbFvDxpZzGhtoJW+abMABFLiwHZZVKGCxwZ13F+RXMg3wna6pyKId:fsJdIJb91U5iMZVWx23FsXHqYv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Heimdall.exe

Files

Heimdall.exe
.exe windows:6 windows x86

8f287f4b9dbe83cf388912931ebb883c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InitializeCriticalSectionEx
CreateFileW
HeapSize
Sleep
GetLastError
HeapReAlloc
CloseHandle
RaiseException
HeapAlloc
DecodePointer
DeleteCriticalSection
GetProcessHeap
GetTickCount
PowerSetRequest
WaitForSingleObject
WriteFile
SetEvent
GetModuleFileNameW
PowerCreateRequest
GetLocalTime
OutputDebugStringW
GetModuleHandleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
CreateEventW
HeapFree
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
SetFilePointerEx
GetFileSizeEx
GetFileType
LCMapStringW
CompareStringW
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetProcAddress
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
GetCommandLineA
GetCommandLineW
WriteConsoleW

user32

ReleaseDC
GetDC
PostMessageW

gdi32

GetDeviceCaps

ole32

CoCreateInstance
CoTaskMemFree
CoInitializeEx
PropVariantClear
CoUninitialize

shlwapi

PathFindExtensionW
ord219

mfplat

MFCreateMediaType
MFCreateDXGIDeviceManager
MFCreateAttributes

mf

MFTranscodeGetAudioOutputAvailableTypes
MFEnumDeviceSources

d3d11

D3D11CreateDevice

Sections

.text
Size: 114KB - Virtual size: 113KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8f287f4b9dbe83cf388912931ebb883c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

ole32

shlwapi

mfplat

mf

d3d11

Sections

.text Size: 114KB - Virtual size: 113KB

.rdata Size: 35KB - Virtual size: 34KB

.data Size: 3KB - Virtual size: 5KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 114KB - Virtual size: 113KB

.rdata
Size: 35KB - Virtual size: 34KB

.data
Size: 3KB - Virtual size: 5KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 5KB - Virtual size: 5KB