Met[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Met.exe
Size

8KB
MD5

41e046fb39265cbc6139b144607dca6c
SHA1

dfd30b81eab71456a15c7948288f49223331fba4
SHA256

f0a2ba964ec8d2e4c469d52ad11a2bd57f988dc458bcf82f73d28d09f1db0533
SHA512

2ad5ddcad8e0b2b51381a5a0261f3630977084a2940be45952182fd8be405c62cb1ebcd85a65e3fb4b1c7efc0fd80001641fb2c25675252b2fa14f02cb279aeb
SSDEEP

96:X6VPVo1ytuG3bCR/OAnoYSaFfHiQnHSPJ0gfNhVUIfHKhJqNI+fzNt:X6VCknbm/ogfFnHO6g7VUIChJqNlJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Met.exe

Files

Met.exe
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

\\192.168.49.119\visualstudio\Hollow\Hollow\obj\x64\Release\Hollow.pdb

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ