8a9548ec82d44138ffd000b365a00db7b3c37dd96a8beb40c5630875f9bd01fa | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8a9548ec82d44138ffd000b365a00db7b3c37dd96a8beb40c5630875f9bd01fa
Size

73KB
MD5

11b4273fef1e2a6448b0628580f1e5bd
SHA1

24fb1309b8ccba5694fa107004ae3672a2d4a60a
SHA256

8a9548ec82d44138ffd000b365a00db7b3c37dd96a8beb40c5630875f9bd01fa
SHA512

96c9e757e970cf5fe0d8a31c8d350f7a80ecc726938e2f3dda36978acf74f07578cb009776491a9892453f3e3ce6edc2790cf9d02b8821eda61ec4efa7cc3a0e
SSDEEP

768:ZrItKyw5WHXfQmjIiIk9ecAx7pP1EPU96MyXPdtldE9bIIIwjkk:Zr3Z5IfQmv81x7pP1r3yXPdtnyjd

Score

10^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8a9548ec82d44138ffd000b365a00db7b3c37dd96a8beb40c5630875f9bd01fa

Files

8a9548ec82d44138ffd000b365a00db7b3c37dd96a8beb40c5630875f9bd01fa
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.htext
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE