Matryoshka[.]exe | Triage

Sharing

General

Target

Matryoshka.exe
Size

10KB
MD5

5c7482a5bc0d07bacc3f0018174c1695
SHA1

7a80a45cf0de91abdd03f1575c301108560f2b2a
SHA256

1435573a32925265a6f67a9521b03ca851faa710e52b66abbbfc899b3769902e
SHA512

9a850e16dc177af9e97ae56c7b1a6af5c3877851db9f96a1b79a2c7138c60d22f52c6a6fcf59935848d304951d287297194fd49e72ea349a917fdb48beedd63a
SSDEEP

192:brvI8o8kTdp1P1V1DKiddg/utklmveWOCBhPZgy:brtkTdQAS2tklmveWOCxg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Matryoshka.exe

Files

Matryoshka.exe
.exe windows:6 windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 360B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ