EXPUNGED[.]exe | Triage

Sharing

General

Target

EXPUNGED.exe
Size

290KB
MD5

485f31bc4bfdc745b793cba18b0c2af1
SHA1

72e495dbbfdaf076252393d603c48a920f8c7aa2
SHA256

6f2428c14a4ba15eaf7fa1e0559c3ac1e6a97bd0cda2cc3fa60ccb11bc588e79
SHA512

738a208adc984f6829e357ae106ce13df134a74268944551adfbd5dab58441c438817db88bbb5853b577163bdde26767733d60567e78e2721afd239426de30a7
SSDEEP

3072:x5/mZr0xNfoPCUf8OYZbB4ya2TKGJA4IPKfjK/S8C:r/3NQYNB4QKGHC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
EXPUNGED.exe

Files

EXPUNGED.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 265KB - Virtual size: 272KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ