EndOfSub[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

EndOfSub.exe
Size

878KB
MD5

e82c5dc4c2db098369aaaa04903988a5
SHA1

f7bd272be285c085bca901d99870e73c38bc6137
SHA256

327839b3528a7e872112b555da95284fa30b1036a4647222ef3ec8055b26e2f8
SHA512

ec0c40919cf7ed725af4e956938ded294c982da4cb4b3bd3799637473c537cbdf725edb47aaeb5d037f9b83419c47fb28ca464f4addd007cc51564f0418a9841
SSDEEP

12288:Ix+7b5Hk0BJ0q/0qgkjCNMgxVGG7OmlJtxG5ySt7Kmy+NCkeIfOb/Z2vVCO2CI5x:Ix+/BJ0CR4VHOmhyMmB3fOF2vVCO2z5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
EndOfSub.exe

Files

EndOfSub.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Administrator\Desktop\XetalPanel\Client\EndOfSub\EndOfSub\obj\Release\EndOfSub.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 876KB - Virtual size: 875KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ