35be0a2a2c05536085bb0d3f1fd6024ce8eab49376dc2a98536f0bd57c0ca332 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

35be0a2a2c05536085bb0d3f1fd6024ce8eab49376dc2a98536f0bd57c0ca332
Size

10.9MB
MD5

c4c435a668df6ed8e3fde82b9a924190
SHA1

8d4d4b022a3e762846c404226c31980cdf4ca624
SHA256

35be0a2a2c05536085bb0d3f1fd6024ce8eab49376dc2a98536f0bd57c0ca332
SHA512

528565fd99a47cf1d5739ce5553b159196cb859115471ccd70cacebfb17976fbdf9f97cf395135fe24b5c53cc8865234787b989850770dfd14c9f2ac8bdc153e
SSDEEP

196608:ChOsH/RITs84ED3384dwl/BhvvYAuAfsWrL3yS96pq7ul8:ChJ6TsX03VdwlaAfsWH86ul8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
35be0a2a2c05536085bb0d3f1fd6024ce8eab49376dc2a98536f0bd57c0ca332

Files

35be0a2a2c05536085bb0d3f1fd6024ce8eab49376dc2a98536f0bd57c0ca332
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\china\2200\Client\Release_China\Client.pdb

Sections

.text
Size: 6.9MB - Virtual size: 6.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 118KB - Virtual size: 62.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.IIDKing
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.enigma1
Size: 2.4MB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.enigma2
Size: 260KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE