Eleven[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Eleven.exe
Size

245KB
MD5

1e39b568797b75e7eadd588a042fc769
SHA1

ac82fa5117d9dc4526b2fcbaf43064a10fb15728
SHA256

6e186759a295769532955874c1be88fdb2f2622fce6381d26f346370847c7fdf
SHA512

523e643ec60202aa6e75989db721a0b87ce577288e1cdbefbd2b7036ef1150e240abf66dad890969f02f3e00f843cdb638ffd246843ebcdc8d8892f32516fded
SSDEEP

6144:zfx/LcTEyF1dH3VOVw44UOisbaxHUsAxyOzk9jA2Zb:aBREcUkHxy8yA2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Eleven.exe

Files

Eleven.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 242KB - Virtual size: 242KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ