rlb-rework[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

rlb-rework.exe
Size

1.6MB
MD5

0ce496f7be5993897ad77579cf409642
SHA1

c43efa63deb73bd64e8cddde9159d73a444d5bb6
SHA256

43105121ab586a16867673fc671861194ed4b6f59943df80d5bf3332d996a80b
SHA512

580b034a8196262095264c85fd0141ed04158024db5823b703cb4efe85e5771648e28137cca5f61883bf9e241f6cd6b04f5a8dadbdeb05ddebad6e886b3ff3af
SSDEEP

24576:sxJuLSD0CZ356Woud2yf/pM4+trje6B/F5bCgI1:sOLzCZ3gWouzZM4qtI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rlb-rework.exe

Files

rlb-rework.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.soar
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.lmao
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.protect
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ