rTTSwiftCopy[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

rTTSwiftCopy.exe
Size

644KB
MD5

d312ec6c46fb78e9d03079e6d940802d
SHA1

c944f9989bfd8210ebf4f7cd66f84b4995f26988
SHA256

1a3f9ac2abe62763028d1975825e0058620a4c1cd4cdc6ab9ace7b34f5a1eacd
SHA512

7af3ab968c53d45ade96af800a8ebcd4226dcf9ff031d5f60de73607968f2cb4e26b0818b222f392c25d577fc16e92f15e5b85dbce71a932da4fa35b1823a39d
SSDEEP

12288:YR361h61EWGj5qzNlkOVqlKkasGarzFcPkn0ZuHy23XByrx0MleCIWIQQyM61:YMY7GjWNKOVi6xMB220sjHByOge5X89

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rTTSwiftCopy.exe

Files

rTTSwiftCopy.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 626KB - Virtual size: 626KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ