Mars_Services[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Mars_Services.exe
Size

16KB
MD5

c24440e09098f81a9ac5849192f2ab3a
SHA1

82b9596e21c60f0aeacb4b073a5d119700f2212c
SHA256

9ea0a3b0e602b2ac9936ba4c224787ca2207cfe658717bbd335c6b5c47d9445a
SHA512

ef8e23608593d6399464533474fdaf62e7a9dfaa8d38ae7301d555c7aa9767b59d2a894be805a2f017bfc3fd70e2a2d5d5089c7aba1e548abc4a023011a79429
SSDEEP

384:SleQFNGDV5y7bjlwm2ukTNRgO7PR1lptYcFwVc03K:ieQivy7bBILNRgO7PR1ntYcFwVc6K

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Mars_Services.exe

Files

Mars_Services.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\BeeCZ\Desktop\sc 2\PERMDISKSPOOFER\diskspace.cc\obj\Release\diskspace.cc.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ