Static task
static1
Behavioral task
behavioral1
Sample
cyanmischa.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cyanmischa.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
ecc.js
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
ecc.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
mbedtls/library/entropy.vbs
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
mbedtls/library/entropy.vbs
Resource
win10v2004-20240802-en
General
-
Target
cyanmischa.zip
-
Size
1.0MB
-
MD5
58a568929158e557512b8811284a9027
-
SHA1
2e4ccfe364e1a0414ddce42afbbc3173fa9538b9
-
SHA256
97b3ea837509a6f7c009e29f0ae31ae180108bf42739a49c2508637e9b95089e
-
SHA512
c87b6b4bd3a14498daaafb8d455ced2e1dd71725e30ff760d0a9aeeffff9e21d786476869b5ac5132c98babbbbf1fd970a4bca34f05a44c2187962ae8a942ab9
-
SSDEEP
24576:rLJXpcZIjnHrljJSlybBe6XAmvzTMILUIRJgc8UojqmbfufQBNrFj:r1XpcajLBJzk6X9/7UpTWoJj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/cyanmischa.exe
Files
-
cyanmischa.zip.zip
-
cyanmischa.cpp
-
cyanmischa.exe.exe windows:1 windows x86 arch:x86
2da5a79229f31eb1659f3344af2c1754
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
user32
ShowWindow
DefWindowProcA
GetFocus
GetForegroundWindow
GetWindowPlacement
GetDC
GetAsyncKeyState
PostQuitMessage
TranslateMessage
GetClientRect
GetWindowLongA
CreateWindowExA
SetWindowLongA
MessageBoxA
DispatchMessageA
GetSystemMetrics
GetMessageA
SetWindowPos
RegisterClassA
kernel32
GetEnvironmentVariableA
GetTimeZoneInformation
WriteConsoleA
GetACP
GetOEMCP
FileTimeToDosDateTime
GetStringTypeW
WideCharToMultiByte
RtlUnwind
SetConsoleCtrlHandler
WaitForSingleObject
CreateSemaphoreA
ReleaseSemaphore
GlobalAlloc
GlobalFree
MultiByteToWideChar
GetTickCount
GetProcessHeap
UnhandledExceptionFilter
ExitProcess
GetCurrentThreadId
GetVersion
GetEnvironmentStrings
GetModuleFileNameA
FileTimeToLocalFileTime
FileTimeToSystemTime
SetHandleCount
GetCPInfo
IsValidCodePage
GetUserDefaultLCID
RaiseException
SetUnhandledExceptionFilter
HeapReAlloc
HeapFree
HeapAlloc
MoveFileA
GetStdHandle
GetCommandLineA
GetSystemInfo
SetFilePointer
GetLastError
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetFileType
InterlockedExchange
LoadLibraryA
DeleteFileA
FindClose
ReadFile
GetProcAddress
GetFileAttributesA
Sleep
CloseHandle
FindNextFileA
GetModuleHandleA
SetFileTime
WriteFile
QueryPerformanceCounter
GetLogicalDriveStringsA
GetFileTime
GetFileSize
CreateFileA
QueryPerformanceFrequency
SetFileAttributesA
FindFirstFileA
gdi32
DeleteObject
SelectObject
SetDIBitsToDevice
CreateCompatibleBitmap
CreateCompatibleDC
advapi32
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
Sections
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_TEXT Size: 398KB - Virtual size: 398KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.CRT$XIA Size: 207KB - Virtual size: 228KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.debug Size: 28B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
cyanmischa.map
-
cyanmischa.obj
-
ecc.cpp.js
-
mbedtls/library/aes.c
-
mbedtls/library/aes.h
-
mbedtls/library/aesni.h
-
mbedtls/library/alignment.h
-
mbedtls/library/asn1.h
-
mbedtls/library/bignum.c
-
mbedtls/library/bignum.h
-
mbedtls/library/bignum_core.c
-
mbedtls/library/bignum_core.h
-
mbedtls/library/bn_mul.h
-
mbedtls/library/build_info.h
-
mbedtls/library/ccm.h
-
mbedtls/library/chacha20.h
-
mbedtls/library/chachapoly.h
-
mbedtls/library/check_config.h
-
mbedtls/library/cipher.h
-
mbedtls/library/cmac.h
-
mbedtls/library/common.h
-
mbedtls/library/config_psa.h
-
mbedtls/library/constant_time.c
-
mbedtls/library/constant_time.h
-
mbedtls/library/constant_time_internal.h
-
mbedtls/library/constant_time_invasive.h
-
mbedtls/library/crypto.h
-
mbedtls/library/crypto_builtin_composites.h
-
mbedtls/library/crypto_builtin_primitives.h
-
mbedtls/library/crypto_compat.h
-
mbedtls/library/crypto_driver_common.h
-
mbedtls/library/crypto_driver_contexts_composites.h
-
mbedtls/library/crypto_driver_contexts_primitives.h
-
mbedtls/library/crypto_extra.h
-
mbedtls/library/crypto_platform.h
-
mbedtls/library/crypto_sizes.h
-
mbedtls/library/crypto_struct.h
-
mbedtls/library/crypto_types.h
-
mbedtls/library/crypto_values.h
-
mbedtls/library/ctr_drbg.c
-
mbedtls/library/ctr_drbg.h
-
mbedtls/library/dhm.h
-
mbedtls/library/ecc_point_compression.c
-
mbedtls/library/ecc_point_compression.h
-
mbedtls/library/ecdh.c
-
mbedtls/library/ecdh.h
-
mbedtls/library/ecdsa.h
-
mbedtls/library/ecjpake.h
-
mbedtls/library/ecp.c
-
mbedtls/library/ecp.h
-
mbedtls/library/ecp_curves.c
-
mbedtls/library/ecp_internal_alt.h
-
mbedtls/library/ecp_invasive.h
-
mbedtls/library/entropy.c.vbs
-
mbedtls/library/entropy.h
-
mbedtls/library/entropy_poll.c
-
mbedtls/library/entropy_poll.h
-
mbedtls/library/error.h
-
mbedtls/library/gcm.h
-
mbedtls/library/legacy_or_psa.h
-
mbedtls/library/mbedtls_config.h
-
mbedtls/library/md.c
-
mbedtls/library/md.h
-
mbedtls/library/md5.c
-
mbedtls/library/md5.h
-
mbedtls/library/md_wrap.h
-
mbedtls/library/padlock.h
-
mbedtls/library/pk.h
-
mbedtls/library/platform.h
-
mbedtls/library/platform_time.h
-
mbedtls/library/platform_util.c
-
mbedtls/library/platform_util.h
-
mbedtls/library/poly1305.h
-
mbedtls/library/private_access.h
-
mbedtls/library/ripemd160.c
-
mbedtls/library/ripemd160.h
-
mbedtls/library/rsa.h
-
mbedtls/library/sha1.c
-
mbedtls/library/sha1.h
-
mbedtls/library/sha256.c
-
mbedtls/library/sha256.h
-
mbedtls/library/sha512.c
-
mbedtls/library/sha512.h
-
mbedtls/library/ssl.h
-
mbedtls/library/ssl_ciphersuites.h
-
mbedtls/library/ssl_misc.h
-
mbedtls/library/threading.h
-
mbedtls/library/timing.h
-
mbedtls/library/x509.h
-
mbedtls/library/x509_crl.h
-
mbedtls/library/x509_crt.h
-
salsa40.cpp
-
spongent.cpp