USB-file[.]stealer[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

USB-file.stealer.exe
Size

395KB
MD5

db6412baa71318435da870d3c2b61a90
SHA1

004d82a203b1d1e642965cde386b6c6ac8937c45
SHA256

32ab025e3e76ac6391c388228e6931c338ebc54e3bd424ed50be2603bf36eed2
SHA512

faaa4d408b071bc2e40c072b460db6f39125fe80e9fca981cc27c18db669457b690fa6616242701f5bebf28bccc69fd82ca4b8880157628a3ff4221c0bd1492c
SSDEEP

6144:vvgXJzzsMunLSFjm3sphpsMunLSFjm3sph:H4zuLSFppSLSFpp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
USB-file.stealer.exe

Files

USB-file.stealer.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Sergiomarotco\Source\Repos\USB-file_Stealer\flash\obj\Release\USB-file stealer.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 392KB - Virtual size: 392KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ