BlackFollow[.]exe | Triage

Sharing

General

Target

BlackFollow.exe
Size

11.9MB
MD5

ac77dc295569830549a3b55e66384319
SHA1

be4248b8891bf8156af8a1890093ca319e16b49c
SHA256

b788983ec5db4507a9b73ea4db216a4b587dec87470d3ebbac6410410f6898aa
SHA512

99445df6c86b250d25b7f2d5fe327b4303d1fa4360eb3d92c360492728aba06a84cf1e1d94bcdcb578d696ed7daf1d3a641b47300ae71b0d1af216437730362b
SSDEEP

196608:FhJQsQCvgWkEHvCcZMF0SUpOXdIN1WDLtdnZs64qAixvo6a+zry78rl3:rysQCYnefI0SUpO2WD/ZskxvdP2Yl3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BlackFollow.exe

Files

BlackFollow.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 11.9MB - Virtual size: 11.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ