Static task
static1
Behavioral task
behavioral1
Sample
sort.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
sort.exe
Resource
win10v2004-20240426-en
General
-
Target
sort.exe
-
Size
52KB
-
MD5
99f961eceea8529a9a6744da30f3712b
-
SHA1
9891d0304e34d68baa3f53626f4ef6b52a23376e
-
SHA256
d6ed251f343319dc852535bbe5dc7b5a60f023fb4e751bb142e6f39d3d3dbe16
-
SHA512
aba2b1c310a7fe5d97773c91afc29c8de8f009aae0ac08d6cbb9b66d0bae5c71798afbd805fb0f37993309335d3506ba083f8381f74ed9a3f3a692b92fa560a5
-
SSDEEP
768:ydG6lsrUftizNUBqWHieyl/NwZcsYcXg+e1wLr8L+zpE/1OOPhyqV8Ho:wG6mrxxC7Hin5N7sYbwL7y1OjH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource sort.exe
Files
-
sort.exe.exe windows:4 windows x86 arch:x86
67130fe2c3db13506e6530fef6b0be9a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
msys-1.0
__assert
__errno
__main
_ctype_
abort
atexit
calloc
close
cygwin_conv_to_posix_path
cygwin_internal
dll_crt0__FP11per_process
exit
fclose
fcntl
fdopen
fflush
fileno
fopen
fputs
fread
free
fstat
fwrite
getenv
getrlimit
localeconv
malloc
memchr
memcpy
memmove
memset
mkstemp
putc
raise
realloc
setlocale
sigaction
sigaddset
sigemptyset
sigismember
signal
sigprocmask
stat
strchr
strcmp
strcoll
strdup
strerror
strlen
strncmp
strtod
strtol
sysconf
unlink
vsnprintf
msys-intl-8
__printf__
libintl_bindtextdomain
libintl_fprintf
libintl_gettext
libintl_textdomain
libintl_vfprintf
kernel32
GetModuleFileNameA
GetModuleHandleA
GetStdHandle
VirtualProtect
VirtualQuery
WriteFile
Sections
.text Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data_cy Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 1KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE