CI[.]Client[.]exe | Triage

Sharing

General

Target

CI.Client.exe
Size

7.0MB
MD5

e9a44ce9c368f5b315cceff62c9ef503
SHA1

68048abd8c4e65adb1c2595e15c44472182d6681
SHA256

90ac1aa29369ec10abc8597b39cc15c3b69ac50a7c1b653364fd779bb46cc57b
SHA512

3a6e952b45a2c79231fa3be004110a104d32d598c9f7c9b3fdeaad6eb361959cb6fa6f2136e62421a911d49cdb1589b176073edfd04d47de3760a4cc5b5bc973
SSDEEP

98304:BUyiJ5A2N9G1NA65uf6zAlFeIwHWWoC3Wofow5mO0pO:BUNJ5A2N9G1N7uf6MjsWb2CO0pO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CI.Client.exe

Files

CI.Client.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 6.9MB - Virtual size: 6.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 141KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ