putin[.]exe | Triage

Sharing

General

Target

putin.exe
Size

1.3MB
MD5

1181b60d1b2f613141858e09f5baed74
SHA1

c1ad5d6e20153c60310059110d2981c5551f32f5
SHA256

a54871a86ea0ab334357133661e3e5b36e8b03e91f6037639315e109499339a7
SHA512

1aec1047cd576325e2ceb62e98a1e1349e3cf2fdd2393cb22f36af253f66df426fbf94e697e43d4ddcff1d2f6be1c930c18632c4ebdb5c9f312879a451250117
SSDEEP

24576:ZXeNLwOs5l6z5vsVq3OnxTHZscDtY2t43QeUFZP7VgK:VeQlmsV/dlDFXeUFB7VL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
putin.exe

Files

putin.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Berkos\Documents\Visual Studio 2017\Projects\antyproces\antyproces\obj\Release\antyproces.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ