BackupScan[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

BackupScan.exe
Size

385KB
MD5

7a5047ee7284680ff2d610fc010f78b9
SHA1

85e6acb7f616c0cc72e3c8d53030b2a288d19c06
SHA256

8611ba103ab5902325f1bc3535dd27d7825d5fe68fbdaf4fd8e4034fa9a8cf89
SHA512

db253f74cc2c58de70146fc8d3131cc077d2bf98f0665093912ac1c5094f788d96874bada23b1371a21bff5b149028bdfb0db05b6dfb07966117fe42e340caea
SSDEEP

6144:+6HNvGp2VVj50mAfys9zDO8C3JTvxU/JJFUxQR53p9U1Y0xt5N:bHxGp5mAL4QfFUa53pSxt5N

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BackupScan.exe

Files

BackupScan.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

BackupScan.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 369KB - Virtual size: 369KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 1024B - Virtual size: 712B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ