Static task
static1
General
-
Target
GhostTool.exe
-
Size
3.9MB
-
MD5
9cfb694437da25a2b1d6bb8e0f875301
-
SHA1
2e188cee2d6ffb963f46a2a5159ae65bc6f0f3ab
-
SHA256
d484cd6eb7a1d817b1fa4afe6fe71a76b01ffaaafbf9613acb49a03904603858
-
SHA512
ad0c52131b20f225667763bf49c97e2a840c78501b315c8670921d9c0bdc0fcfcc942111574eea8c07281bb8d4a8b14da2d9da2e5ea0e7d3d274ad50ec11761b
-
SSDEEP
49152:qT+l5PiTUxc+wNvUb92K/kYvnkxyEUzC88J4x5TumleS5C9Nh6Uz:EgC9CU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource GhostTool.exe
Files
-
GhostTool.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 3.8MB - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 116KB - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ