spoof(1)[.]exe | Triage

Sharing

General

Target

spoof(1).exe
Size

5.0MB
MD5

faa230814b3175744742a86b9f45acc9
SHA1

8949df25e9e7be494f071434dc450e5c83981a40
SHA256

9e25bcc68028b1cefe660e4cf9e00b2a3dbe50057e9c256ffc97bb0582367cbf
SHA512

bdda0cad30e2196f237961f2b5115151ae09d08cefccb5f12041a544eeb035d5852e50aaca8611f0d9d86bf11740a8a921a334f3d9f4b6f7c229a90396869b43
SSDEEP

98304:eRqiZIxFBL1r6YWwfp4zF4AzUArkThRqiZIxFBL1r6YWwfp4zF4AzUArkT:eRqiKtcYWw8DxkThRqiKtcYWw8DxkT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
spoof(1).exe

Files

spoof(1).exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 5.0MB - Virtual size: 5.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ