d7a2d85b33f0436c8e804f72d98b34d37e88f6221327a168387e4184ac23e9bc | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d7a2d85b33f0436c8e804f72d98b34d37e88f6221327a168387e4184ac23e9bc
Size

13.3MB
MD5

2cb43d971cfab0faa1683af5b60cece7
SHA1

432220c0279717ab90c6d9d557d11425f7bc6445
SHA256

d7a2d85b33f0436c8e804f72d98b34d37e88f6221327a168387e4184ac23e9bc
SHA512

45a34f02c39f47e06f94118bdbe1fb95bc65342c87497d56198fff5e29d23f04e9a8effb93a3696fedddc2a27e3fa9a9900280975bee0c24044ecd922d86088d
SSDEEP

393216:ru3pbcqzeiMXB6gPDFasWH8r9j4B262jsR9zW6gx2TA:ru5ZeiMXxPDFaLcr9jL5jsbgxGA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d7a2d85b33f0436c8e804f72d98b34d37e88f6221327a168387e4184ac23e9bc

Files

d7a2d85b33f0436c8e804f72d98b34d37e88f6221327a168387e4184ac23e9bc
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\china\2200\Client\Release_China\Client.pdb

Sections

.text
Size: 6.9MB - Virtual size: 6.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 118KB - Virtual size: 62.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.IIDKing
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.enigma1
Size: 4.9MB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.enigma2
Size: 260KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE