1bz7KfahvU[.]exe | Triage

Sharing

General

Target

1bz7KfahvU.exe
Size

888KB
MD5

72a526934e0b03a0de1a47dc4c6855d5
SHA1

55737c3dc09220cfc0be34e7cc74c50edc08e6ce
SHA256

5e7487094667a01a849e30264c5786354b2de5078e5fddc229a60b90e86becc5
SHA512

7d61c2f1fc480fb4fe9b26d3e4fc79bd6876e529e2e983246cb0d628bb6c3aa431072d78c54b9c5d2b6c16bc562f652ba3bad0431888dcf8b63796f3c1050c6f
SSDEEP

6144:mE2kQVjnzTZfLWlDCy8J1nDtTbhBgxj1rnLaDOzAjyrVefuKwyuc0u9TrObV/XDs:piV7zNWcJ1RxOJ9fAmrU9YA0VbWYzAx3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1bz7KfahvU.exe

Files

1bz7KfahvU.exe
.exe windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 334KB - Virtual size: 730KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.symtab
Size: 512B - Virtual size: 4B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ