PowerChanger free sh[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

PowerChanger free sh.exe
Size

21.1MB
MD5

50a8c8fdb8ebf407a63d92af02feb3c7
SHA1

370e2cc81d2444b65dfb7e95b4fad835eca1ddc3
SHA256

5c544fc9d1f376122d8c07c625b9ab5e87baf1bf094e9ba3ec0eb698609eaea4
SHA512

d60c14e4bd3d5e56b0eaa158f515b0b231d6df3ff090d279ca09b9d5cb131a4f6fffccf2d79fc8fd91520f9d3bd57ff4813c022ce909d9b8793430268d79e8cd
SSDEEP

393216:WyAsTEb8v3UJaoUOcj42XQLoNAph4JMRPgtyRvCiETA1k8dIt7EjYD9lZMih:0sTz4NAtNAD48NRv1GqIBD7h

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PowerChanger free sh.exe

Files

PowerChanger free sh.exe
.exe windows:4 windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: - Virtual size: 10.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.LI`
Size: - Virtual size: 10.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.Q I
Size: 21.1MB - Virtual size: 21.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ