Client[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Client.exe
Size

541KB
MD5

3fe3968f210890604cf7706bd800c88f
SHA1

5c3be497e7e69aa3d22f4c2337f3650d8fc826e1
SHA256

2a1ffc2f44d187b90c5ceefef05fe4a8640c2c177de7c2781792cc0b9201673a
SHA512

5cada1a90383186d16bcda45bc29e60896d7257e692adf9203c8dbcb1e6769f9d73c7ee667185f6b388deb7bf4eca8925e6a2888ee8e1a7c741e513b5d1f4563
SSDEEP

3072:rLiCYEAAFFAiCZSDAh+ik2O/dcDF6G2pYEZplIGG5jcKNgDjyodMlyyTxWuoqBlx:rjYqlfRtxpYM+eHEouoqDu5kq+YJ1X

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Client.exe

Files

Client.exe
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\itssh\Desktop\projects\ProcessSpoofer Pro Dev\Client\obj\Release\Client.pdb

Sections

.text
Size: 431KB - Virtual size: 431KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ