cfg[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cfg.exe
Size

545KB
MD5

3c39c262befc6b80c1708847c6844d5e
SHA1

8aa6d7dcd9592c6453e2c8b57a6ca7ed56d64be1
SHA256

edc5d70b5058cfaa7cd84dff4b2d833f68765a1b0bc8f2e976294600b136a8b2
SHA512

c1f4614ce68696e5adc4ed3bc41a37c66ebdb49b8917fd9118440255161b98a9e79907effdb1cb366fa57683fea67412e478b2663cf0359a27971af394a3d532
SSDEEP

6144:22X2/a7QOi85kCL23EXVYqL2e6VlWT8b9kAM3Zn1cgagnyrCdjt2bA0pvZiC4kB:2ry0On2CoPVle8kbcg/nyOdBkEjwC9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cfg.exe

Files

cfg.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 542KB - Virtual size: 541KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ