Static task
static1
Behavioral task
behavioral1
Sample
Var Tools.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Var Tools.exe
Resource
win10v2004-20240802-en
General
-
Target
Var Tools.exe
-
Size
66KB
-
MD5
baaa53cfee0058f07d5176eb289811f9
-
SHA1
cf402bbf653941ed45fca67e7438f91534455265
-
SHA256
7e39cdbf78d06f611e9c4164bcd0bce86d71f0a6bc1e7afaccfb211fbd394347
-
SHA512
308b4bd3b8ee82e4a936bf8ca039da98406c8bfe2393074188c88af2f031c8cf6d2533cdc3b35171a13355436b2b8807d885d0f1d0bd9ee7ad13b83aaaad1298
-
SSDEEP
1536:cWACYNzwSPwmUM1PX7go+O93JV88rhpHNxOMs:cDN1tw41PX7Jf88rhpHNwMs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Var Tools.exe
Files
-
Var Tools.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
aU[hJ Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ