RestrictedAdmin[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

RestrictedAdmin.exe
Size

8KB
MD5

14f46d8d0f85ea457da2c4958b7b8ea4
SHA1

bd90dd336892112656ffec5325637831291cc753
SHA256

bfa2f0929139c38e451e2a7ff1d51d0a430808bd9d2c9b3aea745438da49504c
SHA512

b930ba6812d329582a378d7f15243555aeb876528fe6e71a4c011b485eba117acf8d3191bdd6f270081143d1b39bb34b2fc6fbb120c1640c5f175e05c1bb6b2a
SSDEEP

96:h1w6zoz9uzW9tNxu7H0pH6+xBfkAKpc1GepFYRcQ6ChkN7GjGBzNt:/wEOtTXmHg68fkLepCqQFhkVSGD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RestrictedAdmin.exe

Files

RestrictedAdmin.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ