3e59c26165d12c83d08abdfd4098b7e492299372a5819129ec33101071218e3a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3e59c26165d12c83d08abdfd4098b7e492299372a5819129ec33101071218e3a
Size

72KB
MD5

5681b1f80f5bef2cb4a791a166136073
SHA1

df2fcb7ab0f3b0eee3385924151790850eca8aa3
SHA256

3e59c26165d12c83d08abdfd4098b7e492299372a5819129ec33101071218e3a
SHA512

1d233f767e7d4c2c88e07880830d46cbd7d75767c0f349c8c5ec59e548f174c0cca66f2b5178d9d3eddd064f879095245dad3dc63f846385eca92d8b1cdab52d
SSDEEP

768:ZrItKyw5WHXfQmjIiIk9ecAx7pP1EPU96MyXPdtldE9bIIIwjkz:Zr3Z5IfQmv81x7pP1r3yXPdtnyje

Score

10^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3e59c26165d12c83d08abdfd4098b7e492299372a5819129ec33101071218e3a

Files

3e59c26165d12c83d08abdfd4098b7e492299372a5819129ec33101071218e3a
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.htext
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE