z38DHLs_Express[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

z38DHLs_Express.exe
Size

681KB
MD5

cc5571cbdec0f9e83a5cb352f4a25deb
SHA1

a086d4c15db25bccccdc36e903f7fc9cedd2f3e3
SHA256

cf26893a8bd70ef1981e3cad7cf075dee61e8841709af573178f3ace3f5bd022
SHA512

ad80c51e4f7ba02b2eaf1c39709f2ee660c73493174a032a63e2265368d6f4ab61e3bd728397a9513d375d46c5014562316b3688f60f3d64ea5b18f41f756c0c
SSDEEP

12288:+PFalGESRmKajKM44pBIipmcnRJuwBxYShEGQ7:+PCKM44/IipTnREtShEj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
z38DHLs_Express.exe

Files

z38DHLs_Express.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 674KB - Virtual size: 674KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ