WinSW[.]NET4[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

WinSW.NET4.exe
Size

832KB
MD5

d305d506c0095df8af223ac7d91ca327
SHA1

679cb4c763c84e75ccb0fa3475bd6b7a36e81c4a
SHA256

923111c7142b3dc783a3c722b19b8a21bcb78222d7a136ac33f0ca8a29f4cb66
SHA512

94d369a4db88bff9556a1d7a7fb0188ed935c3592bae09335542c5502ec878e839177be63ac3ab4af75d4dc38a3a4f5d0fd423115ac72cf5dd710c59604db796
SSDEEP

12288:w5KA2umXkgSSWBpeC5wtKDAOQrM3IbMZuuW1phJb9RlTTzIXGa0/Zxi0akv+9a9h:wleX1phJbpraX0BvX2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WinSW.NET4.exe

Files

WinSW.NET4.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

PDB Paths

D:\a\1\s\artifacts\publish\WinSW.NET4.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 829KB - Virtual size: 829KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ