GhostBanFN_Loader[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

GhostBanFN_Loader.exe
Size

188KB
MD5

58ad5c174ac3cc327c330f6ea0220f01
SHA1

bbfd3592dec386ca97beea3eaa7675376800d2e7
SHA256

de9e91be18f7d20015e95b7b6e1cc55c52d43e4e5ea69b6a734c95ecd4b95825
SHA512

23b73b5c8d484959fd55f8839c62db8cfee74f2b31bca414a5f18f1e6565321e46fa6a60c9b1c92227db6d6e1d37d7d033073925c5bbfe029971db01e14db563
SSDEEP

3072:F1F8e25qB7FwGGFZ87yfZ6xLw5o/DfSrwB/HoP11Gq6t865qY:zFb258yGYe7yh65w5o/DUlP11kKCq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
GhostBanFN_Loader.exe

Files

GhostBanFN_Loader.exe
.exe windows:4 windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ