r__demeOnay__Kopyas__[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

r__demeOnay__Kopyas__.exe
Size

1.3MB
MD5

09d8c15c1efb685c0fb7bc9f4ec74574
SHA1

e8ceaf25119dcf55acdb48e3d4f2798232f03fbb
SHA256

e4fd7930aa9a3229b6ce5b48a7ecf11fe22864e31996500114d5688c5c566ecc
SHA512

37cff4c6f51c46f21dd4f6586996ac21c91fed5967bbe11a995493b38688cd73fbf20934ffaa095583ccafd50f4ce16ad74430643442c68a5478b9b994980a3a
SSDEEP

24576:W19icU4RxhtMIFOUVz84lEQrJZWj/0rfDGS:W19ieB8yrxrL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
r__demeOnay__Kopyas__.exe

Files

r__demeOnay__Kopyas__.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 998KB - Virtual size: 998KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 290KB - Virtual size: 290KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ