nanocore | wlmsexe_JC[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

wlmsexe_JC.exe
Size

182KB
MD5

a1d4eaa6f0f151d604a1e6f79583ff88
SHA1

0388fa9634f697cf371cd51ee28654a19f051bee
SHA256

d1f622488a88176e81cdb1cb8669f586803c2dff54f660ac72a18f0a1d27194c
SHA512

a2291c4d121061098bf9102bdd9bf304d96f53f9ba39a813973d29af4c6a88ae982aae5bfd3be1a7ffd005eabef4331f3fdc882020978e46fcd601ce564c351b
SSDEEP

3072:qfpQ+eycKYOl5xUP7BEhoGNSuFraxC9+JPQcU8gJu2JvVT0mLjqZ9NRbqzyxXNsE:qfpQ+vJKyGTs+tP0JSmLjqZ9NRbq+x9r

Score

10^/10

nanocore

Malware Config

Signatures

Nanocore family
nanocore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
wlmsexe_JC.exe

Files

wlmsexe_JC.exe
.exe windows:4 windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 181KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ