HisClient[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

HisClient.exe
Size

191KB
MD5

1bf07108093f0eadadccaa9d3f0a36b9
SHA1

2635603bddfb9460de7f52690bc366311f645fd2
SHA256

ca5fadfd2d48a35a72ea70449b822fbd8a4e7d2e67df90296b80b2b361f79dc8
SHA512

39b23f1815b5742dc83737312690c248cf1e3bbb81f93e88e1d4a81765eba8a29e56104370249cee5fc1ffe260ec7ad677d0c42921ef9ca92bb4898f3ce25102
SSDEEP

1536:GQZz+FCvHulwVppppp5p0pppppLH0aUHczXrAHP/zxssdLxfdfIdffTMcc8XZ3:px+YOlaxjduTs8p3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
HisClient.exe

Files

HisClient.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\workspace\guiguHis_full\Guigug.His.Health.ClientHost\obj\Debug\HisClient.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 173KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ