WinWar[.]GG[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

WinWar.GG.exe
Size

4.2MB
MD5

371e12c51f8fa0efa6a7e7db768161e0
SHA1

0cab6714be5bcf00bc162fb8674ebb1fca1784cb
SHA256

1b63987552e146bc24b5361c786fba8bfa5303bfa540c507f4373d5d761225d3
SHA512

7a2fbd0e9a78b836a31799780106be7f74f01e9a420901ddc34c6490b99d7f8f29d86d98f7e4a004d58730b2fc7d627066cba3d865f19fb0a524343ed266decc
SSDEEP

98304:gd7m+ij9HD0+jCihNRkl/W6aG/wcKnfu8NUT6K:b+y4ihkl/Wo/afHP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WinWar.GG.exe

Files

WinWar.GG.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\mario\Desktop\Axiom Outdated Perm\obj\Release\PhantomSolutions.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ