Crowbar[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Crowbar.exe
Size

4.3MB
MD5

3ec3b40887c5cf7962773e60dfb201bc
SHA1

d9e8c971af104fe9e095d3917683ad63a6a03c28
SHA256

b723a406a7f99a5565c10dd6e8c8de02e8988f6162e7fe44bd0e9ca9d58ebad9
SHA512

01ee89e1f4c0a963b4f2b139bae118479565f38bd556244fae976b103b13c657aa2610bbf18952d0d5cb86faeff8997d7f574f64f075f556204c309c742dba8c
SSDEEP

49152:bmEVdZRzpCm9wROW5TUBJ55rfAocpl1LVC8aoLCE4c4OTernGmcFxs/0JhxCU5:zwDNA5Kb1LYvc4Ovfs/6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Crowbar.exe

Files

Crowbar.exe
.exe windows:4 windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 152KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ