Golove[.]exe | Triage™

General

Target
Golove.exe
Size 31KB
Sample240205-msf7rsgabj
SHA256 18ba6cd59749904247bade4b75429e2ac2c4ee2a6fe206ebd114e89283f8f5db
MD5 e9dc029457e9d23c8db988c4c0585bfa
SHA1 3d670aa59c97d831e5097b69734b994bf4144cbb
SHA512 3a6138fd199b3cd0a12f4a1ca193823b32afa557a3d7af5e279cc96edb3fcab31fcf6bbff357d089331f47a295e83222f17a45be3dd4254de88b06bf98f379a9
SSDEEP 192:+np66k5gQDVAU3l6+eKdv3Zn4TJrJfsQ5XfDcyLwaBg1+Cfs2LzwYDK7UlVSq7j4:GO/5AwJtZ4RFskLt
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Golove.exe

File Explorer

Golove.exe

.exe 31KB

Golove.exe

IMPHASH a6d84f352ba25f867567969527b4e319
SHA256 18ba6cd59749904247bade4b75429e2ac2c4ee2a6fe206ebd114e89283f8f5db
MD5 e9dc029457e9d23c8db988c4c0585bfa
SHA1 3d670aa59c97d831e5097b69734b994bf4144cbb
SHA512 3a6138fd199b3cd0a12f4a1ca193823b32afa557a3d7af5e279cc96edb3fcab31fcf6bbff357d089331f47a295e83222f17a45be3dd4254de88b06bf98f379a9
SSDEEP 192:+np66k5gQDVAU3l6+eKdv3Zn4TJrJfsQ5XfDcyLwaBg1+Cfs2LzwYDK7UlVSq7j4:GO/5AwJtZ4RFskLt
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\admin\Desktop\Project\reverse_tcp_c\reverse\x64\Release\reverse.pdb

kernel32

WriteProcessMemory OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle VirtualAllocEx CreateRemoteThread RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter GetModuleHandleW SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId RtlCaptureContext GetCurrentThreadId GetSystemTimeAsFileTime IsDebuggerPresent InitializeSListHead

vcruntime140

__C_specific_handler __current_exception_context __std_exception_copy __std_exception_destroy _CxxThrowException memset __current_exception memcpy

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _crt_atexit _initialize_onexit_table _register_thread_local_exe_atexit_callback _c_exit __p___argc exit _cexit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv __p___argv _set_app_type _seh_filter_exe _exit terminate _invalid_parameter_noinfo_noreturn

api-ms-win-crt-string-l1-1-0

_wcsicmp

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh malloc free

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing