Static task
static1
Behavioral task
behavioral1
Sample
mimilove.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
mimilove.exe
Resource
win10v2004-20240802-en
General
-
Target
mimilove.exe
-
Size
24KB
-
MD5
c67f3497c310c01018f599b3eebae99e
-
SHA1
d73e52e55b1ad65015886b3a01b1cc27c87e9952
-
SHA256
cc585d962904351ce1d92195b0fc79034dc3b13144f7c7ff24cd9f768b25e9ef
-
SHA512
1205b5a9a9d2f3fabcce7e53e70e4efce08b21469ae64120beaee67a828d12eeeecddc623b453105ed15990fcc7bbce53175eca6545007f9d68c0aee66e55bc0
-
SSDEEP
768:LK73LxCEQskxjvDoR8a4Tj9gwF6VLCx2l/:LK5uGRl4f9dqCx2l
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource mimilove.exe
Files
-
mimilove.exe.exe windows:5 windows x86 arch:x86
4e1492696c43305d97c6c6a4e8958cdf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
IsTextUnicode
ConvertSidToStringSidW
user32
IsCharAlphaNumericW
ntdll
RtlEqualUnicodeString
NtQueryInformationProcess
RtlInitUnicodeString
NtQuerySystemInformation
RtlEqualString
RtlRunDecodeUnicodeString
kernel32
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
RtlUnwind
GetCurrentProcessId
GetLastError
LocalAlloc
DeviceIoControl
CloseHandle
LocalFree
SetFilePointer
WriteFile
ReadProcessMemory
ReadFile
WriteProcessMemory
UnmapViewOfFile
GetCurrentProcess
GetDateFormatW
GetSystemTimeAsFileTime
GetTimeFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
OpenProcess
GetVersionExW
msvcrt
vfwprintf
fflush
_iob
wcsrchr
memset
memcpy
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_controlfp
vwprintf
Sections
.text Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ