MisplaceMethod[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

MisplaceMethod.exe
Size

378KB
MD5

a2d5854baf35b6ea3a1d5c7b5562abc8
SHA1

7a0348a65b35c1a492354d2ec6dcf0b82648ffd3
SHA256

c03e26eeed7c7e82e68fbfb5ffe1803ae232c39152ef2e62804d64675dc65245
SHA512

6e82772e0b3b58c88b0ec405e6357e092cef4d8071b350a116da662a17b97117ec4c8d70d2a16fe8f66444b82613f5506f09148eba903760740dd8254c8b7f59
SSDEEP

6144:Zu5mWqyw0u2pci32qa+xGBNwW4QxGBNwkiqM:ahqAuni32qaH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MisplaceMethod.exe

Files

MisplaceMethod.exe
.exe windows:4 windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 237KB - Virtual size: 237KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 139KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ