_00430000[.]mem | Triage

Sharing

Copy URL Twitter E-mail

General

Target

_00430000.mem
Size

292KB
MD5

40031f471a08c4909c87a390ea68ccec
SHA1

32f6bc3022a608f970516c298c7009eb561066ff
SHA256

4f14a116e5a3c3abcf64b1fe94d102b6aef1ed96236c2963988273e3b04a2be9
SHA512

4b35a76c38e934a7ee9edc5c785379e79c7b4f99ce196fc6ae37381e517e2ff9b8d0ffe9432d75bb11a7fd211a2851940096387adea5c35c5599c4977c6a3443
SSDEEP

6144:Luk3SHEXJPSjiVJGZKZjwdFUcbZLSlHBNSem+tT9PTBHdo27D:Lv3Sk5PSmVGKZ8CHBN1mcT9PT/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
_00430000.mem

Files

_00430000.mem
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 165KB - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ