ACR - Changer[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ACR - Changer.exe
Size

52KB
MD5

dab7c6b2619ef68707a9a4292d28f750
SHA1

76c0b925f317f179bec2469933a5ddbb7ac020e4
SHA256

0a876bdc59d89e474c83b9beb8affcb9d20bbbffa4bbeef689177487bd9c22ce
SHA512

89a2925e9d4b356441fa9704c1e561df6544907ae2a738d2b7f65776fab565c643698eb1ca7c006cf4637bf445b2d7a346bcf527a20e3cf6fca9b75048ab417d
SSDEEP

1536:a0nuWEiNyxKLDJdQoRlE7dN69yWo2MeJbQOw1jAjRzzj:a0nuWEtKLDJdQorE7dN6AWo2MebRw1jI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ACR - Changer.exe

Files

ACR - Changer.exe
.exe windows:4 windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ