rlbspoof(1)[.]exe | Triage

Sharing

General

Target

rlbspoof(1).exe
Size

1.1MB
MD5

57c9b0afa7618d5b20f66862d5abd2af
SHA1

5da8b0618fe488e54ee9b3829e93f8dfb8bd86ff
SHA256

13afadb98471b64f70c416e0fe4566f997c87e8daebf9c0e89800ebd52e1c451
SHA512

b0f3858105d3c8672d4f3e329ee39298c1bfb55f8f12930d351907c677995be7407808df7bf0ded798adde9e29089c4fc236c22b1b3be46ce0575b4a4ef2225a
SSDEEP

12288:Na8bP+z6JdZiu/pOoSY4mM0UuhENTfYHuxQ11+trje6B+cF5bIkQ3pq+n:Nh06fpoDA3erYHuxC1+trje6B/F5bIF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rlbspoof(1).exe

Files

rlbspoof(1).exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.soar
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.lmao
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.protect
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ