WindowsServices[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

WindowsServices.exe
Size

156KB
MD5

03b59a3ce57ab30fb8851460befa7e0e
SHA1

3a7b888766923369576773a54c76575dfc561461
SHA256

0b2bb84dbd5b5525fd63f8dd9ee178f17744de10b4c01ebe9c0a16ef1bcc427f
SHA512

2001ceb68b2f7b4a090f32bfef4c744f05ca3280dcef6866ab91758fb6d225be1c5993ef0156745ccbfe3f4eefe6b7f627f5a98ef4c657d71be9eacfa49cf1f9
SSDEEP

3072:JDqYmUGvIRTKzsWh68fV23qBJqhT1rCAuV:0vpz/c8fA6BJ8rCnV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WindowsServices.exe

Files

WindowsServices.exe
.exe windows:4 windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 153KB - Virtual size: 153KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 177B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ