Steal_Loader_V2_Deobfuscated[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Steal_Loader_V2_Deobfuscated.exe
Size

5.0MB
MD5

8e18cdf02bb7ea324c498956de3e94c0
SHA1

cfe92e176829566a7c702e3618c059838dc95eb9
SHA256

33fa024446afe27ec2baaecf8da4532cfeaf9ae12002cb6b53bd3bb46c653773
SHA512

3402c195063d812476d8b6b88871729340aa7ca062e4b09176081ea809cd0ed0c86b36e0203b3fefe2cb54937307a7589efc985799cd62e9144bba466f6081e2
SSDEEP

98304:xkVbexNcuvOtF+nBYcitnOFz6ny8u757cxEsTjX2/1s3CdD0pFuxnBBuW5PyzU8x:GVbezcsOtF+nBYcitnOFz6nyN757jsTq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Steal_Loader_V2_Deobfuscated.exe

Files

Steal_Loader_V2_Deobfuscated.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 5.0MB - Virtual size: 5.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ