@Reversalz[.]exe | Triage

Sharing

General

Target

@Reversalz.exe
Size

399KB
MD5

405b83904eb7196251b259003f099fbd
SHA1

6822dff8e268ffaa48b004cfbf9ade497ce3711f
SHA256

d9d4198d4afa515a906000498be07b9d6297427bed5f96d1c1b3e7ee87908653
SHA512

ce7508a2d42cfad7942b8d118d4c582c1dd9f3a62e8a42e2f33d415f8c1bcef73d0c16b906a883058c16cc4b119b0bafd6604ab0ef3762650ec7d55ac7a945fa
SSDEEP

6144:vHxtrDdIZG2nqJElpL3im9+3Kz9BngKbtPLLd5MbDDDhxvPWHvPv:f/6TnSEl1yt6zzng0LwxXef

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
@Reversalz.exe

Files

@Reversalz.exe
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\honza\Source\Repos\NL\NLClientApp\NLClientApp\obj\x64\Release\NLClientApp.pdb

Sections

.text
Size: 273KB - Virtual size: 273KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 115KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ