Proverochka[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Proverochka.exe
Size

795KB
MD5

485fb3f7b40fb04eda59f9659c30cb5c
SHA1

dfd1f030a20b28726bee52190ac10c8d4ca25dfd
SHA256

eb6aa2511097c93c10371ecbd64b4837a55b3433b8105fc98c7a38c6600ed412
SHA512

f46db2f5e611f9f934dd61e9196290a4ed5eaf93441edf681bdbcf9ce482ac87f4ad7be96abd4650e5976a7eff7589147e9da770047a644d1c208f15a0ce999c
SSDEEP

12288:KoZnGcWzxPVl2RpKi0GWWrLZs6n4v0NsvRWagu1koXQgVoF40d2T46l/B42vus2C:KoZGcwl2rMPW/jhaQi0GHLus2wiwfvi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Proverochka.exe

Files

Proverochka.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

vr@Dbs.
Size: 759KB - Virtual size: 758KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ