mpDiagnose[.]exe | Triage

Sharing

General

Target

mpDiagnose.exe
Size

68KB
MD5

bacb4cf1785760ac9a6a2dc0ccd08651
SHA1

d6287da821497734dd0e3a8fd72ddca1b7193321
SHA256

dbb6a7322001ebef20a2a7818779d69726e3a6269263f6e82ddab9050bdf4f1b
SHA512

475a93615eecf62732a4d8d5649f32c89d3cb4ba90a556976ee1c8b94c0ad997bab162e3de7734be6aa54d6c27699b4417441073627bd6c712b87a4ed3c8bc33
SSDEEP

768:2PXQoQhSlRQBnJ2WNYdDlrl6W7SO/flTGrnM/rWMl7D55h:2vsSlR2nJ2zdH6qSOFTZ/iQPzh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mpDiagnose.exe

Files

mpDiagnose.exe
.exe windows x86

b9475144a4bff0d84836e741bf3b8cf1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

MethCallEngine
ord621
ord516
ord517
ord518
ord660
ord666
ord595
ord598
ord599
ord520
ord522
ord631
ord524
ord709
ord525
ord632
EVENT_SINK_AddRef
ord528
ord560
ord561
DllFunctionCall
ord670
EVENT_SINK_Release
ord600
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord712
ord606
ord607
ord608
ord716
ord717
ProcCallEngine
ord537
ord645
ord570
ord648
ord571
ord573
ord577
ord685
ord578
ord100
ord579
ord613
ord616
ord617
ord619
ord650
ord546

Sections

.text
Size: 60KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ