CryptoThingShaviThing[.]exe | Triage

Sharing

General

Target

CryptoThingShaviThing.exe
Size

214KB
MD5

93c69783b1e443fe976b2ca50d567e4e
SHA1

cd573ab74c1b75251a1f4c6963549aabaf2d77e7
SHA256

cc90ef3d7c1ec75cc369152c8f04a908f38e186e9624b1589c94b2105d4f12f9
SHA512

09c86166e8bd2d34d13e6dc724bfe55f2a01f6784b382956c350a30db909ed30e2b5c614db324011535a24508d727090f4d510f16994c4b3b23794cee70b1772
SSDEEP

3072:Sx/AaAtOlVqypZ8yqgl8nhp2BTnCn0VdQ0xz1+ydrk0OUQ:S/AklVqXyqgl8nD2pFXx51Hb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CryptoThingShaviThing.exe

Files

CryptoThingShaviThing.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\vetle\Downloads\Telegram Desktop\CryptoThingShaviThing\CryptoThingShaviThing\CryptoThingShaviThing\obj\Debug\CryptoThingShaviThing.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 211KB - Virtual size: 211KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ