PR_bot[.]exe | Triage

Sharing

General

Target

PR_bot.exe
Size

54KB
MD5

d9baed970f55fb97a56ec6779a991e78
SHA1

dc2bd93ac06ef4f76358ef19228a908270be4cce
SHA256

a619649762da31e462cb8c7f20dd3a092600c2751447e2bb0d156e06c286cbd2
SHA512

ba60949307b8b9b3b5ca8d95464a2c7e538403f75a10fcfc55e75f0e82b1d58e22fb90c48dde5d14fb8ce080d5438b5352e43f011debcd9c0bbc5a225232dd16
SSDEEP

1536:PhwWc5GuFXtsPTMj6V8KhsaoDMcYYa50:qGuIPTMjKoDMc60

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PR_bot.exe

Files

PR_bot.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ