OfficeApp[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

OfficeApp.exe
Size

1.0MB
MD5

d3655aa081e980d98e2711f094598863
SHA1

eebc8f1b599ace1e5a810f631ee35c4769e5916c
SHA256

0b63cd9b604f44ee660759dbc569ce32e20ba5093684846eb1ca9ecfcaba4a30
SHA512

fb3d885b938a63accb6ab134ad617b4aca503ec4ce8d57cfd2f82ed15c2a3128e97734611f453cf682ffa4a3d6fdf8e24d0f20c204f2219cee25c9aba422249b
SSDEEP

24576:H0UdM1wc9ZH4rPZ9FeoW8ogXq80JorX99B:H0UdM1wc9ZH4rPZ9FeoWdgRu0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
OfficeApp.exe

Files

OfficeApp.exe
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\source\repos\neat-x64\NeatWapPackage\OfficeApp\obj\x64\Release\OfficeApp.pdb

Sections

.text
Size: 888KB - Virtual size: 887KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 185KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ