EvilExtractor[.]exe | Triage

Sharing

General

Target

EvilExtractor.exe
Size

18KB
MD5

951576e30378ff8494c51fb83765a508
SHA1

06eaf78c2e06fa1bdb2b463171a8709137175e33
SHA256

405f36ca6e4565a5e457125a60e9b9aa04acf5f82df95f48a120283a5ebcbe6d
SHA512

2aac1bc9c0c683b52e6a6674eef3382ed1c854a313132f992de0ee4914e30dada2bf4af962ea1c7b0726c523ef21baea3538aadf7674846d27f541792184b7c4
SSDEEP

384:cU4NJkFi/B5DHf+UWgQQYXXpyN1cdQzmTLxrZNebnZSbO6mZOT9HsQjTPrwwVn:+kFi/3DV0g1cdQixAKF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
EvilExtractor.exe

Files

EvilExtractor.exe
.exe .wsf windows:4 windows x86 arch:x86 polyglot

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\EvilUser\Downloads\EvilExtractor-master\EvilExtractor-master\EvilExtractor\obj\Release\EvilExtractor.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ