FinalMom[.]exe | Triage

Sharing

General

Target

FinalMom.exe
Size

2.1MB
MD5

3e49b6cac5be120299270c07cf5f3663
SHA1

b2d6755975661bd5bd715a6f937744f2649c5d24
SHA256

26fd5540e8f035f066f3d5f8c1992c53d03ec18c07678226dd822a259431ffda
SHA512

f6094b941135b2d96e03ed60ca75d0c95d3ee16f00cd6775660f8f493020fbaa835e8aae7425a661d951e0da65c04fabe9e9dbaf1fd270543dcb64391bd350fb
SSDEEP

12288:27XnYkSp+IpAOEv3yS2Rd6a6cXPjmNcrHRV4hx5eTFmCPzihw/PTx3lMOlpUelLO:wXKp+IuZvc6yyNczIhCpmC7ihgL6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FinalMom.exe

Files

FinalMom.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

`6Ye*t,
Size: 419KB - Virtual size: 419KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ