blue_shift_full_eng[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

blue_shift_full_eng.exe
Size

136.8MB
MD5

9b6833d5456ff1a18a6bf429eac381b2
SHA1

7381d04d73ea68cea8b37b29d3ce1dab275bb0c5
SHA256

7a4fe57424c4bb47051a468c470363ec6dcdd61c6743073e357d80078ae6c02a
SHA512

b178267705558a72dd1a540ef62c7ac242df20fb7742df077d062b7f5e4391b7d03b29e4ae59764322100222b6bb3351e16d008b6dc44ae4bdec6eb830a2b4e0
SSDEEP

3145728:QjPspRYnMuxghdak/TBRYAvQwDq/gzpGguOP3dUs06AsmPwpa5uf:QjPsEntghdx/7Yz4MOP37ArIf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
blue_shift_full_eng.exe

Files

blue_shift_full_eng.exe
.exe windows:1 windows x86 arch:x86

Password: 777

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ