0fd8047a6e0cb38d2b0b7eb9f582499c44889ff8f29db438d3960824e0e2f32f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0fd8047a6e0cb38d2b0b7eb9f582499c44889ff8f29db438d3960824e0e2f32f
Size

65KB
MD5

67ca9e7ab1922509f85c38a33521dcdc
SHA1

95f7ee06dcc5a8a650bf7f3d9724706ba730d587
SHA256

0fd8047a6e0cb38d2b0b7eb9f582499c44889ff8f29db438d3960824e0e2f32f
SHA512

657cf44ce898ce06f0573226159d4aac1a5e2ed390302c0ea1dcee94a61a52a7e2ed00286cd7c48f2588f24544278b34338e39b52883af771070acff72781389
SSDEEP

768:ZrItKyw5WHXfQIhIiIk9ecAaVPD96KyX6i:Zr3Z5IfQIR81ad5yX6i

Score

10^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0fd8047a6e0cb38d2b0b7eb9f582499c44889ff8f29db438d3960824e0e2f32f

Files

0fd8047a6e0cb38d2b0b7eb9f582499c44889ff8f29db438d3960824e0e2f32f
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.htext
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE