CITI USD10987 PI[.]exe | Triage

Sharing

General

Target

CITI USD10987 PI.exe
Size

925KB
MD5

6dd5b074dc21fc159a5e98c448dab3e5
SHA1

9be431a3d0fb17e0d7b69c62d288a7b47804fd36
SHA256

a5395961ee5eeddf2c81583e2eb11dafe8f8ebcc350204e0c8344e4d3e1614e6
SHA512

bbd3ea1bbe5e44f04973389ca391eab78f456a673fee59bbeed8368462dbc5a819bd5c929f8e5103337e3beb82002aeca5bc80ff25d3741fbe46c05c74e909db
SSDEEP

12288:8IOZByuDs0aOFF9EcBeK4cwyLO/uVvrvhytVJJbngUJo37DV4ELPr0MecveyyOGp:aoeeK4PmtuJUw4np3HLcp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CITI USD10987 PI.exe

Files

CITI USD10987 PI.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 919KB - Virtual size: 918KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ