honeypot[.]exe | Triage

Sharing

General

Target

honeypot.exe
Size

2.4MB
MD5

ab82e4c0bcb8bda3df172b6360a06b94
SHA1

e41217abdee78d9e5c3835bf57a8d460a3da13a0
SHA256

48e8733462baa85a1afd34a8dad588a989f431b12e2361001d95d5963a8f0da7
SHA512

ead1b0f74d9a3fca1460c809012655feada85d5160191debafce959b655d89f1f8c815b0401cb43cd1c980dd32bce50164952a1e74f33b918353f6237e62d99c
SSDEEP

49152:hLjq/dlOM7qMjRnBJ/MzV47Zb/9BPABYZ77/RFkqXfd+/9A9TSanGfeKdb:p+dGMjRT/eV4dJTkqXf0FoSW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
honeypot.exe

Files

honeypot.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\berke\source\repos\Eclipsed.Light\Eclipsed.Light\obj\Release\honeypot.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ