zrdjma[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

zrdjma.exe
Size

108KB
MD5

e9cefd9d47f4d3b97019ffe265e5a22d
SHA1

9471ff87d6fcb259313cf279a0102a4c4667f2bb
SHA256

91bc5557615a7978705c0e9861f7a7bc2cdc70cac4e938b1822fe6f62a609e6e
SHA512

6c2b748d48262b0caf115a32d84556dfabc5b35fc15a6696a1c5932d8cbdeada5c572bdb0c9e11274806f161ab4b2cf70eb03d813186b81e86bbe9f80873df10
SSDEEP

384:SHQaVM5arC/vKm/clCUcKmdM0MXuugm1tftdFRmGn2aQa6883C:ST65arlCBKsmBRX2883C

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
zrdjma.exe

Files

zrdjma.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Administrator\Desktop\Cordano\Cordano\obj\Debug\Cordano.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ