Umbral[.]exe | Triage

Sharing

General

Target

Umbral.exe
Size

216KB
MD5

a3903d2bc73ca24e4e6f285b46c6723f
SHA1

117d82e0f908374978e0131815e8eb0d49c92a5d
SHA256

7f591a25fd50c6cd918a92d9560e431b7b8930303a6af7d2b28077e668d2f7c0
SHA512

722c20dd5eb4527f2274fc54cf069922534d4b5a93652160c9e16c04017cc71587bccdab85e6b8bdbf562a10d3c6b27775dd2b9983e601970a622854b8134405
SSDEEP

3072:BmpcjvqySgPAZ+D9Cocawot18PeX6cDgjNk/JlsDSl8eN7sq4XJcGTSYu:ccWoPA8Rrt18jcDgNI8eNYLpS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Umbral.exe

Files

Umbral.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 214KB - Virtual size: 214KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ