WhatsApp[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

WhatsApp.exe
Size

286KB
MD5

1eac4a61ec35bbcb1830284c384d76d6
SHA1

464200d37e36730154eccb0121e73b5fb2b7fd11
SHA256

5e9d7645468f0f9ce31d8e68327f030492d9d4027839abab579e7c730c001e00
SHA512

5c7ec7dafb2996b31921b5f4f5af32612d71db91fe1b37424f123e77731e7349897ef89e05cd79bbe1cfefd22073da5a217308bc5414774ab8ce59d45bfa4c34
SSDEEP

384:cRtxiSmUjUQ/0Baxc8IcbUi+7AOut6HMf82utc2NSJzXpQT34aOe9sRS872UVTSh:cRtxiSmUj5ISXy34arSlay34abmn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WhatsApp.exe

Files

WhatsApp.exe
.exe windows:6 windows x64 arch:x64

f12299573f995fc0c70b04fabebb3e6c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

whatsapp

RHBinder__ShimExeMain

Sections

.rdata
Size: 512B - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 283KB - Virtual size: 283KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ