boss[.]exe | Triage

Sharing

General

Target

boss.exe
Size

439KB
MD5

7d0f3d9a9bc6b47ec1ac4cc94af65a22
SHA1

816e29273ce1b4aef292daaa86fe3d0ec72a9fe6
SHA256

e0bc4f6bddc8eed8801ff23a921559aff7c3d16d131441ea27d0702c9c9818ec
SHA512

93b49989475073ad39fe7ec7ca0f5cacb75123b42d6634ad0ea02d2b1ca8c2a8e2116578c80862493adb489944033244c236baa7acfaee9fdfd0ff84a1cee640
SSDEEP

6144:wjCSLtrDdIZG2nqJElpL3im9+3Kz9BngKbtPLLd5MJDDo552:CCS96TnSEl1yt6zzng0L1E

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
boss.exe

Files

boss.exe
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\honza\Source\Repos\NL\NLClientApp\NLClientApp\obj\x64\Release\NLClientApp.pdb

Sections

.text
Size: 420KB - Virtual size: 419KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ