Static task
static1
Behavioral task
behavioral1
Sample
Device/HarddiskVolume3/Users/tomphilip/AppData/Local/Temp/NER86D7.tmp/Toolbar.exe
Resource
win7-20240221-en
General
-
Target
Toolbar.exe
-
Size
206KB
-
MD5
216044ee366b18762dbd88b44f17eb40
-
SHA1
80b9e88e738bdb7fcaf5c7ad2fcc158182e3e789
-
SHA256
8df178881e8b75967bc0d637dec79f0c8ef74aa69d34469edb6c5f54bc02d2f7
-
SHA512
4e63a1aa05651d17801c94bbf894689f493628cb5b3e67519831a3692ae07f81fc5ebc4d624ffd44d6f8a04ad553d359c22c9be6668da1d4fff009adb5de49d2
-
SSDEEP
3072:fes+5ywGAwXH+cn0/tftYgr6qXVd/G4b0cW5ic5dw5RjBZQ6o40n8WMsxzW:fes+5ytB3RyeUV93bO5iP5NQJ+spW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Device/HarddiskVolume3/Users/tomphilip/AppData/Local/Temp/NER86D7.tmp/Toolbar.exe
Files
-
Toolbar.exe.zip
Password: India@2023@@
-
Device/HarddiskVolume3/Users/tomphilip/AppData/Local/Temp/NER86D7.tmp/Toolbar.exe.exe windows:4 windows x86 arch:x86
Password: India@2023@@
aac60df60ca85a65dc1aa5d99d8cccdd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateDirectoryA
lstrlenA
GetTempPathA
RemoveDirectoryA
SetCurrentDirectoryA
EnumResourceNamesA
GetUserDefaultLangID
WriteFile
CreateFileA
LockResource
LoadResource
SizeofResource
FindResourceA
GetExitCodeProcess
WaitForSingleObject
CloseHandle
CreateProcessA
GetPriorityClass
GetCurrentProcess
GetCommandLineA
lstrcmpiA
DeleteFileA
SetFileAttributesA
lstrcatA
GetStartupInfoA
ExitProcess
GetModuleHandleA
user32
CharNextA
wsprintfA
Sections
.text Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 906B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 64B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 456KB - Virtual size: 452KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
manifest.json