Phemedrone[.]Tools[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Phemedrone.Tools.exe
Size

48KB
MD5

4f4c66fd4fbe6b72b197ccc41afa4350
SHA1

1302a1aa04c83b1990f48747bb070f34fab55ead
SHA256

133007f48b1245eee04351b2305596d2651efc3226ceedd7301f8d0988abf437
SHA512

0892385a6658442d2d29fa14093f531a4d472a4d244cd74b6b30b6ea0440c7f7c7a81128f36cda4a6d1546373e09ee0db24275ed83ccb05b088139949e6533af
SSDEEP

768:yk77PnJIZOP6SIzDUmS2qv/BPHh5+aMHF6r48kG8u5eIgxM3+/:3P/X6SfJpVHH+a4IH5LmV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Phemedrone.Tools.exe

Files

Phemedrone.Tools.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ