Forse_[.]EXE | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Forse_.EXE
Size

2.8MB
MD5

844f0015e57bfa5b48b975ffbd952934
SHA1

c3b137b6565d2f2fb89a3dbddc900a1fedf49206
SHA256

b96557cd64d8e93699c1f4ca0ac9777cb5509f3ab0d96fa657a626c6e412fb3a
SHA512

258c1952609ab0abf981cb2b1735f100f1395c8c733a2dede541b74c41814030c0a4644e1e9aeebe72547acb5d414af2de1aac186eb2a469633c1fac2878f5bf
SSDEEP

49152:XcS9N3hG7xdnpshm/o4xWQdT5/IPI8mdWvwBJBtGgwufFCGPFSg5fn4:X/9Neshyo4xrdT5kmIwBJBtVFC6FSgBn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Forse_.EXE

Files

Forse_.EXE
.exe windows:5 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Sections

.text
Size: 2.8MB - Virtual size: 9.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE