RL[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

RL.exe
Size

1.3MB
MD5

ae68b8df70e8fc24d5728910e03a418d
SHA1

fb564572ec5391953f0dbef412f211811a1b6e80
SHA256

e31205389e5409e2740158029bf1e5fee012cc9d5549d4230ca7fafc887d7327
SHA512

b3f6c1d97cffc6d6de4e0df299f42cfb78a0bacc3406109b82fd3eb65381bc02c25472b71d2f19aa572403c2a7568f30b5842718dd7692b055c2786c4e2cf9d2
SSDEEP

24576:2bNz/1ktX7wI40G3nlJpRy85g9GYxrbtj+2xhpEuf1:Wh/CXtdGXrtg9GYhbhpEuf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RL.exe

Files

RL.exe
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

a8Pa)"r
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 167KB - Virtual size: 166KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ