Static task
static1
Behavioral task
behavioral1
Sample
Polyboard.exe
Resource
win7-20231129-es
Behavioral task
behavioral2
Sample
Polyboard.exe
Resource
win10-20231215-es
General
-
Target
Polyboard.exe
-
Size
37KB
-
MD5
629e3cd6ad34459bef71835905f7a659
-
SHA1
ea1f0071998e8c3aa3f92c2498b64578b3df84c6
-
SHA256
e30a60d16c8fb134b8ea28ab8f61547727af0f43c93abf25d87857a49d7a5e4b
-
SHA512
008171736be34dcb1648448fc909dbcb38ec2a46d6321aaeaf431eb16508fe6ab0f5afd21536d548a4bcf5276bd01df43ae9de4a5661110b32eef0dc0ed10c19
-
SSDEEP
768:TSahTD0HyZdXXsj8HWVlyO2rOT9CarZ11ECRtn84D7gEgzU:hhEydXXQAWd2rOT9Pis8trzU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Polyboard.exe
Files
-
Polyboard.exe.exe windows:5 windows x86 arch:x86
6c81cd28aebf69535c2bc314d2e209e8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxA
kernel32
CreateThread
DeleteFileA
ExitProcess
ExpandEnvironmentStringsA
FindResourceA
GetCommandLineA
GetFileSize
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileStringA
GetProcAddress
GetTempPathA
LoadLibraryA
LoadResource
MapViewOfFile
ReadFile
ReadProcessMemory
ResumeThread
RtlMoveMemory
SetEnvironmentVariableA
CreateProcessA
Sleep
TerminateProcess
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualProtectEx
WritePrivateProfileStringA
WriteProcessMemory
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpyA
lstrlenA
CreateFileMappingA
CreateFileA
FindClose
FindFirstFileA
FlushFileBuffers
WriteFile
RtlZeroMemory
GetVersionExA
SetCurrentDirectoryA
CloseHandle
SizeofResource
shell32
ShellExecuteA
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
comdlg32
GetOpenFileNameA
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 498B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ