Documents for shipping PI BL PL[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Documents for shipping PI BL PL.exe
Size

626KB
MD5

d0a32aa804902edfd2b229bcb4c73be3
SHA1

4a882a1ecb345da2078ffcb22d56059eec8fb17f
SHA256

9e39036b1848c9867521dca9c5e351a69b235b42f760e714f20ae3465ef9b559
SHA512

12dc0a4e12c1983d184c69fb150b2e05e32dbb94a0befc42438a1fd0ec8e1a04c047e36125897c62063ce896926c788fce4cd0607eee651da88c570f63896d14
SSDEEP

12288:a+lSh7kehLadFlZbZeUBr/5myLWdlvTMyISRTTy1A3WJla:a+lShIeh2dFQUey3ITx3WJQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Documents for shipping PI BL PL.exe

Files

Documents for shipping PI BL PL.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

VlEh.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 624KB - Virtual size: 623KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ