GhostAIO_PTO[.]rar | Triage

Sharing

Copy URL Twitter E-mail

General

Target

GhostAIO_PTO.rar
Size

5.5MB
MD5

29e57101133bba292adf35cc51ab297b
SHA1

d0d6514e05258e4a47f1016ca7186b8d0a107335
SHA256

146321ef4dad9300b5336c9b8b79bd1f7094c55d7489f3d818ecdcd09ae87bdb
SHA512

f6dd59f425be484f01e294da0de5b953d6508f3c3fd2be99809da126d136741b5d4311b19d8ac9c66a978145b2ff832e81799e5fa847d3ecca5ad4a58bf92022
SSDEEP

98304:yWS0NNCeWvOfcWiLK5XgQjd/OjDgUdNZLvFaGqac1aoCcnc:Q0NNCDIILKaQp/CgUJLUG0W

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/GhostAIO_PTO.exe

Files

GhostAIO_PTO.rar
.rar
GhostAIO_PTO.exe
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 115KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Size: 5.0MB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 280KB - Virtual size: 280KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE