plasmafreefrfr (1)[.]rar | Triage

Sharing

Copy URL Twitter E-mail

General

Target

plasmafreefrfr (1).rar
Size

5KB
MD5

cc7f6bf5918ad43efc83adb978d758fd
SHA1

0769dece4cdf12d9ed99e50cc8d54e834faf0b8e
SHA256

c930389d3e046826630494d8c0f3fcced045bf0b3fbffa50b2d4cd969c339f79
SHA512

72d3a97eac3f122bfc7f223a0e359f2eed208d82f34b55962c8dd09bf2f468a23d8a1288443c44ccb4ab691f32c716a9f73c89eec18bc26b255c7e4ad04d8131
SSDEEP

96:pBtaWJTXlrGTgqarhYU8tmFkgGM3FAzbrQff3BdCDED4i6cUrFp0:pzaWXGUqKhYU8t2T3Kzbr8v2O4i6cUrs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/plasmafreefrfr.exe

Files

plasmafreefrfr (1).rar
.rar

Password: 1173
plasmafreefrfr.exe
.exe windows:4 windows x86 arch:x86

Password: 1173

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\plasm\Downloads\code\code\code\code\code\plasmaisud\PlasmaFree\obj\Debug\MoonwareFree.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ