EMRServiceConfigTool[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

EMRServiceConfigTool.exe
Size

87KB
MD5

12e3fa8a0924ccb8b543e00b1b64fedd
SHA1

a96a16af057f9abcd97025e69c1124c0cbc12707
SHA256

434d396051dbe52f0031e940d07261d3efcca3ade6d3fa32d0b6685fbea0ba9e
SHA512

595a3842944d1a33bf2bfe4497801c32564558fa4b12809b1e5b81313260e51cff458a87b6c6d193eb88f6b713f9a07470a75c5228491be7e0986d1ba01c17d5
SSDEEP

1536:2WOClZcd413uljENUFukvFzNiChX++9EmR6mVPw:2W9Z64eMUF2mR6mVY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
EMRServiceConfigTool.exe

Files

EMRServiceConfigTool.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ