WATERBOTTLENACONFUCKMYBALLSBYPASS[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

WATERBOTTLENACONFUCKMYBALLSBYPASS.exe
Size

59KB
MD5

fb6e28076abefa5625b90f6bec0f64c9
SHA1

88fffff5f64b8af79bee3c2712632861b973469c
SHA256

bd5a174a448e20a7b06bc48522b07160ee8735c792cb65905ee9bedcd8c7476b
SHA512

1a4119bc748d6ef3f843515e9c0b5d7b7e267c178bb25a3f94cfaf9a8ea374f1941eefc479aed5c664ca19e53cfbaefa16bd3941538ed4857fe3ef60f71af1a1
SSDEEP

768:E1gu0q/1TCl9gacTegzpch+o0dLIQMKu:E1gi/1TwgttchPYMKu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WATERBOTTLENACONFUCKMYBALLSBYPASS.exe

Files

WATERBOTTLENACONFUCKMYBALLSBYPASS.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\tina2\source\repos\WindowsFormsApp13\WindowsFormsApp13\obj\Debug\WindowsFormsApp13.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ