Tzhwq[.]exe | Triage

Sharing

General

Target

Tzhwq.exe
Size

42KB
MD5

c9b5783bc626451ab2d0c27b9c9ac76d
SHA1

bac23adef5e496237cf7640f83b460055be1ee69
SHA256

1e0cd5804ef4947f77e9c4d74aad36b7248e1802bed673363243f9bb9ad0f73a
SHA512

718c8ea362353c9e987913b514c5d4ebc5b34c4dac0ae08b9c2bded0e5cb03e342b7195cf6f0be0ff7b1e78e5c3b0bd3bbb0347fa8e3a32bfe812bee6a1fd1fa
SSDEEP

768:j/bdC1bypS0BSpwX5K+LhtvirD+9BvPdD7Ypy:9O0+enLHqnYXdKy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Tzhwq.exe

Files

Tzhwq.exe
.exe windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ