WorkScan[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

WorkScan.exe
Size

3.7MB
MD5

810b37a1a14fb9816454d3fcdff666b4
SHA1

606a174e6a21e41ce65de58b2c613b278dba3ec0
SHA256

3d609a9c5a064be7f016bb1aac6c3acef20eee3c25714c9389a413fc2231e6a8
SHA512

8277ac8b03299e3b47b5c612ede879bf64d588c896cd96961c04a855b61769cd6926b912a4c2e2cfd72e2a919c654b41429a51205c736a3911e5f478bb21a245
SSDEEP

49152:EWZosEqZtqno2xv7KAivAY7dslHJ+FL0ARL3XX+SqVmx1wjaMQO:ExAtqnDR6vdalHJ+FL0A53XX+Y1M

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WorkScan.exe

Files

WorkScan.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 12KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 104B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 175KB - Virtual size: 174KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 868KB - Virtual size: 868KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ