f739393f3ca58476440ce34c832952514e84bd4a2578f1acc3e843d0e027614d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f739393f3ca58476440ce34c832952514e84bd4a2578f1acc3e843d0e027614d
Size

6.4MB
MD5

e05f7c316f5a64da19ace28ef3adfeaa
SHA1

246127f9a5a99656049815fac9b4115fcfec5825
SHA256

f739393f3ca58476440ce34c832952514e84bd4a2578f1acc3e843d0e027614d
SHA512

3657ccbf3aac09aca3fbd59ed9d86aff0ae7ac5a4fa3edeaa505f33106977640549c60727cac657f2090a284c64e9e92c66c6524f30295da0c2902c737603260
SSDEEP

196608:z5KcseaWvzvv9EQaLnsjBHYCNJ7KYODdk:z5DcCH+aByvd

Score

10^/10

Malware Config

Signatures

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Fody

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f739393f3ca58476440ce34c832952514e84bd4a2578f1acc3e843d0e027614d

Files

f739393f3ca58476440ce34c832952514e84bd4a2578f1acc3e843d0e027614d
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\сыгмы\читик\WIN FREE CHEEAT\obj\Debug\WIN alien FREE.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 6.4MB - Virtual size: 6.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ