Blue[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Blue.exe
Size

341KB
MD5

307a68077f059e5ea634795ce6f2f9ca
SHA1

d4cb49601e6d82d43e5546971a10a6f569b4357e
SHA256

d5c03618a27d633f240ee35359a7edb57975145facfeab796999e5e950c6829c
SHA512

a4e71fa43e7eb0bdeb5f3290b3807aefff5937f64368a463c45dd3e0a13803c88f772aeae8984830bd2ee303c53f24d41b3047ef4eaf4842fc5d8436d501ed92
SSDEEP

6144:zsAieqt9D+5aW4PH09gEMcX8S0bqafS2y1IN1azTi:Aiqyx488S0bqafS2y1e

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Blue.exe

Files

Blue.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 301KB - Virtual size: 301KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ