创建流程控制台[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

创建流程控制台.exe
Size

15KB
MD5

fa9ac5fcfc44ba189c9420f88c393973
SHA1

3652f797a995bceaecb160ebef5de7879613735f
SHA256

dd9cbb054e4aa38b3fa5b9c524b3f70c516b4ff1b339fa1ad8455fa68e92206a
SHA512

bc5ea9823f21a5242768105af99c5b00d1ee47a31c6c6c0c89f824f947dc851d67927f15544818a1f96ade52ad6a9ec014bb0d2158dbb362554292e284a79659
SSDEEP

192:rCrtNqi6GZv3oaiYbemmeXYTbe6ryurMffc4xB20mbAke6mHipladba1TVq:e+Q/o6ibe6fxdTdBRab4TV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
创建流程控制台.exe

Files

创建流程控制台.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ