Win[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Win.exe
Size

22KB
MD5

151588f3911a7a10ab15ecf7de96d668
SHA1

430b047435392776ad6962b33422a796d04b7596
SHA256

f7c600f3379cea1a1a7f91aefc7e1b08e79eaf3459caa07b9104bc9c542c499e
SHA512

961bab078555fc0d28cfc3159cf809a0c60d514a0aee6cd059b7ee722ddab78da752f9240eeeaedd6b2122c706adb51a480540c20941595029823cbabe911199
SSDEEP

384:dmsHxD8ktNHUvtIH9g8PMj8AC+Mg4bclVnL4LO9QoeFGHcLBLYLfAqRVBfRuBtY2:HNjDMj8m4bOskB5w1MfAqRVyBtt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Win.exe

Files

Win.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Administrator\Documents\Visual Studio 2015\Projects\WindowsFormsApplication2\WindowsFormsApplication2\obj\Release\WindowsFormsApplication2.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ