groot[.]exe | Triage

Sharing

General

Target

groot.exe
Size

8KB
MD5

fd398c7044a200b5c077864e786897d1
SHA1

bfdfb43098dd0e8a797c1eb3c90fff3ea2513306
SHA256

f96607784c9e01a30e339eea288d38b6171a1b87ae27c4c2f7925599b133a3bf
SHA512

5ab1c0d781bd3b0c6ce1a4d39fd32009818fc0771a479051f4d7d7d50405d75b50255fab3911a183f5abcb6023630c87fc83c79016d4f7575e5d67ec28f8d2a8
SSDEEP

96:b3vQYG57oPzLNg4vsO42Jah0lSlGzMfbAsx0HNC+kYn8K3m0kkIHCo9HwCSzNt:TvQ/or5g40OCmKyUbr4oKW9kIHT9HvU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
groot.exe

Files

groot.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ