pyrochild[.]plugins[.]installer[.]2020-11-21[.]exe[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

pyrochild.plugins.installer.2020-11-21.exe.zip
Size

415KB
MD5

a43ee2916f756e5f18cb1dc6a083cb3a
SHA1

930d540597d3bcd8253490e1f5bc0385ce209a10
SHA256

0aaae4497041ddc8ebef260cb51a139f72762edfe30642916da6f15ffaad4124
SHA512

e715af631e6ce04e1c25ab141b6f077ec98091a4e1b41657da2b426651f052ac0fdf360d992b800a8f2622d3d8d94f629d2bbf69385094747a1e1ed3a4da9b97
SSDEEP

6144:79s3G6HGUev21YP3fjFsxQ2sgbDv0qU2D0B8oj5hIgxmFaVn8fKbVMpSkUttL:79H6HGNvRPJs8gZUC0WWIFaVn0KBJL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/pyrochild.plugins.installer.2020-11-21.exe

Files

pyrochild.plugins.installer.2020-11-21.exe.zip
.zip
pyrochild.plugins.installer.2020-11-21.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\zacht\Dropbox\src\pdn-pyrochild-installer\Install\obj\Release\Install.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 947KB - Virtual size: 947KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ