C:\Users\Minedroid\source\repos\DatabaseTranslator\DatabaseTranslatorGui\obj\Release\DatabaseTranslatorGui.pdb
Static task
static1
Behavioral task
behavioral1
Sample
e6ba907dd137725abcd8cb263a2f2b3e34e521e38828950d5d21a5e44b3b5883.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
e6ba907dd137725abcd8cb263a2f2b3e34e521e38828950d5d21a5e44b3b5883.exe
Resource
win10v2004-20240508-en
General
-
Target
e6ba907dd137725abcd8cb263a2f2b3e34e521e38828950d5d21a5e44b3b5883
-
Size
4.2MB
-
MD5
30f40aba9b97f78a6715ebbb2901b6ec
-
SHA1
4db19c622a458b3d3bedcbdbe1d169f0cbfa38e8
-
SHA256
e6ba907dd137725abcd8cb263a2f2b3e34e521e38828950d5d21a5e44b3b5883
-
SHA512
3dc0866ea9f2250dad0ce02e5855fb764a3a3d766b912894b7b17c44f878b56820e98ab23a91173a7bf89f82df440c31412a31e84ead0c85d35661ca102c61a0
-
SSDEEP
98304:Ym12YVrsk9N8ivyhAdsPSQxYkbdgCM0RwfPOFPz5:5VN8iNIS9kGCZRwfP+Pz
Malware Config
Signatures
-
Detects executables manipulated with Fody 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_Fody -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e6ba907dd137725abcd8cb263a2f2b3e34e521e38828950d5d21a5e44b3b5883
Files
-
e6ba907dd137725abcd8cb263a2f2b3e34e521e38828950d5d21a5e44b3b5883.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 4.2MB - Virtual size: 4.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ