CoreSet[.]WsClient[.]exe | Triage

Sharing

General

Target

CoreSet.WsClient.exe
Size

12KB
MD5

6bc405557877372b4d6ea556e9681e39
SHA1

4f3a26fbce1f9ed9b8b603fc65122b4c29daa052
SHA256

3be1d30f23bedc969168b003a8e9d04781b7c3e112ce74a5cc0f6b5ab751288d
SHA512

9d6cbb1e8a5ad0cf1ac20d7a57f94cf13dbb50ef12eac06b684f0905b061dbae5852a7c9248111830c69e3ea90777b4522c96ed3c014e8a502baf57c2b70c386
SSDEEP

192:qco446U7pLlLADGczGCLVzo09WdLtwFP9UvTRKhKQWfINad:m6U7/kDGcCCLVzocOaP9UvTRFFfINU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CoreSet.WsClient.exe

Files

CoreSet.WsClient.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ