Eleven[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Eleven.exe
Size

249KB
MD5

689d102f64e4a3dbc24aff987e19e34d
SHA1

173ee5f85a08683084d26f9f32612b8b5b11408d
SHA256

abd7d0a9b49140d74f817bfb5ef51977ede599785f346b23f20587121256bcb1
SHA512

90cf30e40d013136bd277d7a58647c219618b76c5e0677e7f37a88c3e183342c4499e1f0b5ac1c49afc5b1442ff5a81114848b2b562bb0b100772c94fdfe8e42
SSDEEP

6144:bx/LcTEyF1dH3VOVw44UOisbaxHUsAxyOzk9jAvyb:aBREcUkHxy8yA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Eleven.exe

Files

Eleven.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 247KB - Virtual size: 246KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ