r[.]exe | Triage

Sharing

General

Target

r.exe
Size

963KB
MD5

d7056ec9d56f1df77cacda2ed75d06fe
SHA1

0a8948df4f8c8c677fbdf9bbecdd6fbfa14bb7e1
SHA256

37a730f1fa06507e43b62965a7e0c5d6d3b9bd612d687a3e4974b0bebe979023
SHA512

cd76d5805d206956650ea63e89acd64977a35ff9d9232b42bfbd921cf976eb57c8faf6be72715e434b3fcb00efe2aa2ee68486ed1d497a4fcc65acb94e6c4f9a
SSDEEP

12288:6SStyDEtxMF11wWjJ/sd6cB9nGh1dtQ1DCQoTjAGvlcFCLAu7FAdBFl+Jl28bSSK:6SS8AI71nsd6mnt1DCQRGvOv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
r.exe

Files

r.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.G
Size: 618KB - Virtual size: 618KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 338KB - Virtual size: 337KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ