start[.]exe | Triage

Sharing

General

Target

start.exe
Size

5.4MB
MD5

9a31e2f6ded277bf5ee020deb4d94f03
SHA1

7758a11eb96e5ff506ea61b58dc2a9a080915fb4
SHA256

6e055dafd01e88043b5349f41333b5b7c3669dad7283eb31e5683067ef1eca82
SHA512

eb24f7f13b7f8e963f0aca56be9a840ac995909d60222c342a9da6e1237ffbf67f34cb0afb8a7226c7935e16d4281206ee6e5624b4f09b2b374397aa974f4360
SSDEEP

49152:qgPHKFIljmc9lDUKorbKNMktJFzyu2YhM8tZ3J0nVjEVWpBC6GJu1rL5Ck8OR:Ff9pmKFtrzHTCNELG6c

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
start.exe

Files

start.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 5.2MB - Virtual size: 5.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 170KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ