Windows Session Manager[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Windows Session Manager.exe
Size

41KB
MD5

4b26dfaa391136e1138fb109d67b7783
SHA1

effa376448734d604a97b1976815006edb207e04
SHA256

9710a5c311ddf764fd88d85921fa784778a95162e560af9f73bea0cc0d503cf0
SHA512

a9242c1fcdee34bf3be88ae36ba03ac8ebecc626fa9c3a711e558a09f3ed74a94c3d6261bcb923095fdcbc22f0ca00933b86b942a1b63ac84f4ff0473d1697e1
SSDEEP

768:o0f3nX/xBqe3UL7TfFPUBC9Lubg9fLelA3KPOwBh:o0/nJBqdL7TJZhlKCC

Score

1^/10

Malware Config

Signatures

Files

Windows Session Manager.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ