winhlp64[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

winhlp64.exe
Size

5.6MB
MD5

9f5ec1f5a1dc666454979758183be122
SHA1

976195a862f625bf8404b06670109878c404c535
SHA256

8e504b62ed5b5be910b2635a8cbed016d5edfd02b310e83325e22e9a022ee4a2
SHA512

052aa2fc0de94fbb6ade90c9c18d5fa51e48214d9c4340a7bbdee7bdf467177da2c25f15838d7432dd2555f443128071306d01e07c6ae5ab3f83bb5ecf9358d2
SSDEEP

98304:qucO/2x+4kG3QMphh1eorWqHlGxnkbnWregn2oifaQqiWfPWgp+S9vXGNLro92s/:/cH+4rlF5rngnkjuH2omqkGvXL9ogbSS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
winhlp64.exe

Files

winhlp64.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 5.6MB - Virtual size: 5.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ