Windows[.]Malware[.]Effects[.]Remediation[.]Tool[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Windows.Malware.Effects.Remediation.Tool.exe
Size

846KB
MD5

17f14bc8567cae7c3829a1edd439f5cb
SHA1

effd2105491b333241835c1a96d205ebfe1550d3
SHA256

44069b3a60369f95bb446c647033cc63eebdb1b00128d4c216c53d6676765ba0
SHA512

ab4ab402fcca061eeb9eab7f69c4138b8bdae6535ffe090f4dc0c7870a0fd57bedf3a476b1f13fe5900443a9086f7d3f7557b91766d6e7d3519809d6a9856eb6
SSDEEP

6144:QgJbU2gIKgIKgI28SUnKq6F/37g4kg48:Qb2gIKgIKgIUl3Vrg4kgp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Windows.Malware.Effects.Remediation.Tool.exe

Files

Windows.Malware.Effects.Remediation.Tool.exe
.exe windows:4 windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 660KB - Virtual size: 659KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 185KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ