Shadow[.]exe | Triage

Sharing

General

Target

Shadow.exe
Size

691KB
MD5

4bc57a49dddd2e7e981ec730516b5fb4
SHA1

e81f310483d51f480d3b065a59f7cf4d115af73e
SHA256

0af9c422ba9cf447f7faf0c575b249f108b20d3f35cb65d760a4aab9cda402d5
SHA512

c8a3ef6ae168fa68dd9d27104caf0bd7683aaea4b57935c786ab8ece152027ef60cc75ae8220afa1eb74f766082c7988246e63500eb502f751568b459c603423
SSDEEP

12288:vbkqjVnl36ud0zR/6CtQ9PUHIG8D3RryFot2wkda7Enp+Nl7HJq2gMZUThHM4zGp:TkqjVnlqud+/2P+AJyFoBkkAnel7prYe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Shadow.exe

Files

Shadow.exe
.exe windows:4 windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 686KB - Virtual size: 685KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ