ADCollector[.]exe | Triage

Sharing

General

Target

ADCollector.exe
Size

528KB
MD5

134c6a513d534a01404f19b2730d68bf
SHA1

2eb961f3ac9940e967959ab9722973815cfc8b18
SHA256

e376d23f48816e9d9a8d74cc9f8891b6fed2cff46d2b0efe989d8272b05931f2
SHA512

26deb96d906460bc465f0de81eb94902e428ec1450a7cc0a9f16a4f73a7e86bc610a0bf6c413e40495deb81ea093972b5b087eed2434ef04f91abb5e971025f0
SSDEEP

12288:Crh1z1E7TxBL927cmjrLf+V696Wsvl66rl6dsk:6EqcI/fly06Md

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ADCollector.exe

Files

ADCollector.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\a\1\s\ADCollector3\obj\Release\ADCollector.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 525KB - Virtual size: 525KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ