297526abdb5bfa5fb20238475bed8436_mafia_nionspy_JC[.]exe | Triage

Sharing

General

Target

297526abdb5bfa5fb20238475bed8436_mafia_nionspy_JC.exe
Size

327KB
MD5

297526abdb5bfa5fb20238475bed8436
SHA1

556db892e7e663deb0019d83fee7696ec2b6eb4f
SHA256

48b4dce954f560e6bb10e7dc227e9df248c793c79976587e093069e5a03abd67
SHA512

bcb164eb419123aa575b6c4b34e6e08eea6b1fb5b465992645808b83f3b3854f1832aa8774dcbb99842c6fa123e2a8b59ca8fbc4e753e58d68f56970ebe92e20
SSDEEP

6144:I2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG8KgbPzDh:I2TFafJiHCWBWPMjVWrXK0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
297526abdb5bfa5fb20238475bed8436_mafia_nionspy_JC.exe

Files

297526abdb5bfa5fb20238475bed8436_mafia_nionspy_JC.exe
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 222KB - Virtual size: 221KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ