Umbral-cleaned[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Umbral-cleaned.exe
Size

226KB
MD5

ceeb8f75066b9930421115f383ad4c0a
SHA1

e0aea4e4a59c0f29bbe825390a2dd41ea8876cc6
SHA256

7b18584a8a78e54f76aae28cdc1b6e45f972cd4eba921ff1993573c9be2b34d7
SHA512

b4efd046445f4de79b28303119e84afeed5852bf95007cdbbaefbf5b94d0f469f5cd88ed32571d846fe99f5455c393202e1f43cbd23ecd2d69ecd65f98c15402
SSDEEP

6144:ZrwDMEzo2yTo6sd/cpTn7LaaGqKGnQ/R8e1mNM:ZszyE6XXYp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Umbral-cleaned.exe

Files

Umbral-cleaned.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 223KB - Virtual size: 223KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ