client_protected[.]exe | Triage

Sharing

General

Target

client_protected.exe
Size

454KB
MD5

be0061137b50b995b369c993aa328832
SHA1

0ad883878b7cc252049af0ed2044091f331c1f7a
SHA256

fc3347a3ae67c400cbd23c7e783d66346456cc4b2cdb1e1ddff0c81e57f2a3c2
SHA512

fe0a8ce4109df51ec6eb6862abd334aebe759b1fd8a3b602956d6df8b72602c325ccbc052267e54c2b017a47d7626edf591562e621eef5b1f97e08541bf94715
SSDEEP

12288:BjVFrnothLliWD5lt3O+7GlenrVK+zlr/ZhD:xbotTiM5lt3hGgnLzlH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
client_protected.exe

Files

client_protected.exe
.exe windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

" QR
Size: - Virtual size: 6.3MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

b�b bb
Size: 365KB - Virtual size: 368KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

�bb�
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE