downer[.]exe | Triage

Sharing

General

Target

downer.exe
Size

32KB
MD5

1fa6565a58f222c40375cc222aec2f4c
SHA1

6f428d504c8127d3af9fa494113b80ad9a53bbc2
SHA256

e0d004825aa070df0dde476b15905b5b8655d74fdf902e9de3004c5cf9bdf217
SHA512

d80119290a6058eda7d10d5716f128779557b6f5773f062feb37a9e9875a391b994439e2750ddb9ca4652ed69cc05d841ed76e15f38965ec71e8f542cb2e8f7f
SSDEEP

384:InYJ0GfxCYB97l7T/JrQ/jCr0p4P8pXujdl9q75i7NXr6:InYJtdB97VTBrQ/HW8pYnq2O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
downer.exe

Files

downer.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ