aQ4caZ[.]exe | Triage

Sharing

General

Target

aQ4caZ.exe
Size

28KB
MD5

e671615e8c6d4358b9a1640d3b474747
SHA1

a26b33b0493182dd1dbb67603bcc23e9ec6f856e
SHA256

78c62b084950829e63223ad3af4b0bc92458c6f0c4ce9e23a9322fef6ab89742
SHA512

7dcbecc7a93590e10295ef738a85769596b1cd4a5c1de146333bf5a74b5222997370f38d4a58cdc5d1d60553440a2db5d2c0abc4a755d82dce0d5dde6f049af3
SSDEEP

768:NBI0c5C9m+ldpwxzH7nkXNJU370GzxoST7LNFrG:Drc5C43ZdoGLNpG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aQ4caZ.exe

Files

aQ4caZ.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\User\Downloads\EZRAT\EZRATClient\obj\Debug\EZRATClient.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ