decoded[.]exe | Triage

Sharing

General

Target

decoded.exe
Size

128KB
MD5

8a683e5c6d08ae32487b931f717c4740
SHA1

d4959ae763a3298fe05298a1d7c706165234c584
SHA256

0081f2b0d75362654a726fcc95945e72dcbe9231658e3b176b53e1b8e21eb9c4
SHA512

0c5a2ed238b1f14bf8573176e7a39aa62039b80f2f22ff65061d275de7fcf66fd907c362149c96e08b605f80010d31a41de675c3091ba9a784c7ee0e80ffe107
SSDEEP

1536:Njl4WbR4nBB8zO+JXtGmNwaNHIdVr8FkNKBQ8xAEUUMnLzw7sHuWatNAPHh7Ei8k:v4WbKnYz9xtv9odVngBQnOmugOUoxhw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
decoded.exe

Files

decoded.exe
.dll windows:5 windows x64 arch:x64

a42d4d6071b7dd15ff139883773ee067

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
ExitThread
CreateProcessA
Sleep
InitializeCriticalSection
DeleteCriticalSection
ReadFile
CreatePipe
PeekNamedPipe
WaitForSingleObject

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl

Exports

Exports

ReflectiveLoader

Sections

.text
Size: 107KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 181KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ