SecuriteInfo[.]com[.]Trojan-Downloader[.]MSIL[.]Agent[.]3465[.]10970[.]exe | Triage

Sharing

General

Target

SecuriteInfo.com.Trojan-Downloader.MSIL.Agent.3465.10970.exe
Size

115KB
MD5

24987ea2d285cd3ffe0953c926a4f71b
SHA1

147175ecc94a1f819f887e3fd53634eeb52d3c3f
SHA256

eb3fa44dc7ab1aab25c61f6148b5f9b6abc1c2bd85f5f1b451c38b4951e23b3f
SHA512

e81cda49c0f1fb52bbb95aca1863f407511820b39e42abddcd2b21d8b636ee55eb69921d39388ae22fe6ef54605229525cfde92ee2fdb64d71799a2c6240a4ca
SSDEEP

768:YQvR4GlQDCJ7+O+A4Qlum+iZpPYcGioeVuPuI7pwJ:PBluGpfWGIlw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SecuriteInfo.com.Trojan-Downloader.MSIL.Agent.3465.10970.exe

Files

SecuriteInfo.com.Trojan-Downloader.MSIL.Agent.3465.10970.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Michal\Vyvoj\Csharp\Tynka\commaTextProcessing_v7\obj\Debug\commaTextProcessing.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ