c0afd0698eda33028f4cec99583d290c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c0afd0698eda33028f4cec99583d290c
Size

1.5MB
MD5

c0afd0698eda33028f4cec99583d290c
SHA1

08276ccd5eef60e0ede616245a8cd6cc488cb69c
SHA256

5d634c75fe3f562f5ec598e0d4cc7af8be379badb7d16c2a1852dc97b3287253
SHA512

cc6fa1d063d2144e704cf1b67eaf5e90259170602d8d74a4a08dfb1a7b7f5820ea514e0cfc13a5556e67c401be5e74048210e3e3cb5f3b337c54cd67671da3e9
SSDEEP

24576:MmDtaLg/DRZhf0deU/N9M+ugdM4WC6wK3Mu2ExfZqhae16CGbfxEXYGaKqMDHQyW:MmDta4tZqhaK6zbfqdlf92

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c0afd0698eda33028f4cec99583d290c

Files

c0afd0698eda33028f4cec99583d290c
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\Office\Target\x86\ship\postc2r\x-none\selfcert.pdb

Sections

.text
Size: 153KB - Virtual size: 153KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 178KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.c2r
Size: 512B - Virtual size: 340B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ