Buffy[.]exe[.]7z | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Buffy.exe.7z
Size

985KB
MD5

c0c53a0f1bb4bd117ea72f80b8922fff
SHA1

ed139b2ec01ff52929e80ccb813ee61567fcc77b
SHA256

120fc1f09873dcf3cd98f124e6fc4837441759422ea9a6126b85a5c8e61b6230
SHA512

63be8610a39eb1ad7e5aba3ca83940a708ffa1d7a10b180b6e3ed30d7275466682257a44be84a154e69ff99dabd7cd739cf4ee59951ebadf7f5b92b819443920
SSDEEP

24576:W/dyLBykqa2K5MIZpyjMLrm6iDAu34ScWwHCuv:W/FkqlK5jDyCWAu3nE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Buffy.exe

Files

Buffy.exe.7z
.7z

Password: infected
Buffy.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ