BackupAgent[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

BackupAgent.exe
Size

48KB
MD5

d508382ed573ddc3effb2ae57ec95651
SHA1

701874cb2620d945eb275e7412367d5dbd65416d
SHA256

515a966327506de89d977fab778c8b969ec7f4e17b125a1543938cc315135f5f
SHA512

4bc81b2fb58d11aa726f50e457d649c9ed59af52286e2ab360e51c424de28eaf1475b8c4afab37604c4b65c77cc0a3694f6699a69cb6c1f168ca7f3a7e5e053a
SSDEEP

768:+KwzMmXnDqMfgvNyylQkYzMQbs7WXiQUsZT:+KwzMmXD0vIUQk5QbsKXiQUA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BackupAgent.exe

Files

BackupAgent.exe
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\Jenkins2\workspace\GA-BlueSky-5.8\Agent\obj\x64\Release\BackupAgent.pdb

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ