predator_malware[.]zip | Triage

Sharing

General

Target

predator_malware.zip
Size

213KB
MD5

f53c8778d5165a75024c8a1d45d2a010
SHA1

ab38b590d56cc04f8734d9a9eef13c14d0d33ffd
SHA256

e72b5d0b996755182896c0dacd0612f17d80398757cbdbe15598df18cd7ec11f
SHA512

b28378b8ebbdb8e876404b475d1bded394e04e86f6cf8d4ea6fbfae7978f56836e4780f2f3c77d4568c63ff6c8377f231aa482a3a6ad561d9d514c09bad49c79
SSDEEP

3072:Zw6mhA5MIecbrjegy6OCRegYwRK2LVNk7Gh2VHffeLKJ73q5jwpWX0Yag8RezSek:OoXFRuwRdNk53SjwpsagA4Se0V0x6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/873546478ec547e4e82af18fa5004c67794141d9cb98e79a4ff84c86a6c6aeb8.exe

Files

predator_malware.zip
.zip

Password: infected
873546478ec547e4e82af18fa5004c67794141d9cb98e79a4ff84c86a6c6aeb8.exe
.exe windows:4 windows x86 arch:x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\MyWork\برمجة\gom_v_4.0\update_windows10\update_windows10\obj\Debug\update_windows10.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 534KB - Virtual size: 533KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ