e036eda681626cc0a7cf380bf2305b5ebd0b69741ce70b41f158bc9d3f56918c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e036eda681626cc0a7cf380bf2305b5ebd0b69741ce70b41f158bc9d3f56918c
Size

65KB
MD5

97f73147e11abebfe25f5e6b4461d449
SHA1

e2b0f8f7511297b5da915096f9ac6eb4d057a6e0
SHA256

e036eda681626cc0a7cf380bf2305b5ebd0b69741ce70b41f158bc9d3f56918c
SHA512

0ee3b2beca57d92ee5bf32f5d9d4ad3241dfb021a3eb65f0f63d92662ccbab3c09cf9ce5edb5c7fd6461783ef39801b044e51b29cd19b7b3ae95e1775b1bb146
SSDEEP

768:ZrItKyw5WHXfQIhIiIk9ecAaVPD96KyX6W:Zr3Z5IfQIR81ad5yX6W

Score

10^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e036eda681626cc0a7cf380bf2305b5ebd0b69741ce70b41f158bc9d3f56918c

Files

e036eda681626cc0a7cf380bf2305b5ebd0b69741ce70b41f158bc9d3f56918c
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.htext
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE