Pegasus R[.]A[.]T4[.]2[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Pegasus R.A.T4.2.exe
Size

167.5MB
MD5

719b803b1ef5194c8758401c24db0bf4
SHA1

abb3b05447f410c4778987f7aaac03a52db5ff12
SHA256

2d6760d50560f6e73a8e445e530ba312d0c5d8021b29858afbad8b2ac9e4dc9d
SHA512

081bd6d62ed5e146c925efef8124aa79b5ab41be72ba5115fa301be704e55e863dacb8d42a26026589058be284df78e759c3a774b5d0482ef919c4eb454f6019
SSDEEP

3145728:QSu1p5vewi5na5jw6GwaFLV3TU3nzBIyelMToqV5D1k2u5fll:lkUwi5ataFxA3nF2eTF91tut

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Pegasus R.A.T4.2.exe

Files

Pegasus R.A.T4.2.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: - Virtual size: 96.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.'%p
Size: - Virtual size: 87.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.,Rt
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l&?
Size: 167.3MB - Virtual size: 167.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 152KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ