8f395b08c86de0232f24b9c3921f5a3d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8f395b08c86de0232f24b9c3921f5a3d
Size

10KB
MD5

8f395b08c86de0232f24b9c3921f5a3d
SHA1

64e63583ee7dbae98654191376cc670998838912
SHA256

f639ecf61ac93ee8138202e11474523aedbb4b91f382abae50a13a2588b2eb30
SHA512

9c3e803a7977003d533cbd125bfc208ae43cfe6231e3f079cdde555d9a3f88d49a73b0764cbc7cc36555aea714fc1309c8225c414cf3cbe0d5c252aa10178983
SSDEEP

192:3biJ1hpDRqz/fxv1MzKOlxaNbr2/1Mhsv87hwsTf:EtWB15KxaNb6G487a2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8f395b08c86de0232f24b9c3921f5a3d

Files

8f395b08c86de0232f24b9c3921f5a3d
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\leewei\Documents\Visual Studio 2017\Projects\ekati 2.0\ruby\obj\Debug\ruby.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ