Terminator[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Terminator.exe
Size

85KB
MD5

de490bc91fe2424a516eb76578e5724e
SHA1

3737115beb8b3a5948146f793bbe4993d512a842
SHA256

c0a929e137875d08fcb21c3955ac2f69eb3b64374bb3237b583e6dc4f4f8e81f
SHA512

f5d7bed70c7615e6059e9a8b15190222ca6a57feef600dea55e9543b061c33d930f18301d77f0267e000f08936a1daf1d73cb1a343849bc657bd91987cfd05ca
SSDEEP

1536:u/5lkp3D3U1CJ9jgpOFzUkWSZE0reqUiXHfVLqYZHP3A2dz3Lszb7Zgfdb8TYtVY:w5s3D3UbeE0jX/Fqqezb7Kf+TY/Y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Terminator.exe

Files

Terminator.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

U~I;M
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

NUL
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ