VISUAL[.]EXE | Triage

Sharing

Copy URL Twitter E-mail

General

Target

VISUAL.EXE
Size

13.4MB
MD5

d2319de48185c04742cf042d2c19b129
SHA1

c4f88ec4bf7bb5f9c48993961257f93f8835299f
SHA256

d599eed2b7b2b26264e1b15bef3264e051f5df377fd1a7de167b73242180a46c
SHA512

a194cf591085f03fa4e9ce4de2eb30da1c912d99293c03a31c44343109ab06cc4015f93c6f548abfad77f9fb1b9050429db3452424d66a61aa1e74ca7abacd37
SSDEEP

196608:d/dUgLNgLFiVkGU7ZbnyjIKF+XiPaw9t6W27pvf3eb1U+eX8T2XoZsXFo5C1o+e7:Vz8FoknBnGfPaOcpd+iY2aI/FFB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
VISUAL.EXE

Files

VISUAL.EXE
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: - Virtual size: 6.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.nigga0
Size: - Virtual size: 159KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.nigga1
Size: 13.2MB - Virtual size: 13.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 167KB - Virtual size: 167KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ