65713c96538abb41b28018317a4c6d2f38276b7e212515ad8a3e9cc5ffec83b9 | Triage

Sharing

General

Target

65713c96538abb41b28018317a4c6d2f38276b7e212515ad8a3e9cc5ffec83b9
Size

2.9MB
MD5

fdaa99b7ea228b68f96716279aed4686
SHA1

82d1c606b4afb52285f7fac1d6f53542e8f06501
SHA256

65713c96538abb41b28018317a4c6d2f38276b7e212515ad8a3e9cc5ffec83b9
SHA512

c6a7adcfbfd7d04cfa0a4d7735b483e5dae08802dac7d81efc7d70c6d4990ccfb6868e50a149bf6da2f094a1973a20ce6ed3323a9ec3965a3340b90c63418fcb
SSDEEP

49152:8mdsFkITgARZ4RsTvCn0WJblEArUYF1+x5ZUCG8wL+dlbmu9zr3C9:6FkITJ6RsTnWJblRF1A5ZUCGkJmu8

Score

10^/10

Malware Config

Signatures

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Fody

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
65713c96538abb41b28018317a4c6d2f38276b7e212515ad8a3e9cc5ffec83b9

Files

65713c96538abb41b28018317a4c6d2f38276b7e212515ad8a3e9cc5ffec83b9
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

T:\Günta\Projekt\VSBot\Optimat.EveOnline\16.Impl\Optimat.EveOnline\src\Optimat.EveO.Ex\obj\x86\Debug\Optimat.EveOnline.Exe.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ