NumChai[.]exe | Triage

Sharing

General

Target

NumChai.exe
Size

17.6MB
MD5

bcdd91505b93ce1e14ad987952fbed08
SHA1

cb21e724e0814cf0304aec12fbf29d6ec5470e1d
SHA256

23541c3d4d3c91c51335895d912cf2a62d7f50ec4cf1b3caf1c10bb8c4961497
SHA512

27cf73b2c7224cb9e3b0949dd09f6d061fd999c6e165afba56148f1c404badb33704e5785c724a05757428ff185065b30b82ee974b3b9366e02fbae4f31af853
SSDEEP

393216:wiW1obI/fL2Vmd6mx2pjhV6q+CdVBkkq3+d9jpwjYJLW8Fw8wPrVs:1W1h/fyVmdP6jhV6q+i3WOd9jejmLW8R

Score

3^/10

pyinstaller

Malware Config

Signatures

Detects Pyinstaller 1 IoCs

resource	yara_rule
sample	pyinstaller

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NumChai.exe

Files

NumChai.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 17.6MB - Virtual size: 17.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NumChai.pyc