DotaChanger[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

DotaChanger.exe
Size

1.7MB
MD5

74742579eee3e5ecef47268f05f7337d
SHA1

5ff869c1ae2f3f9f6db64dbe8d6f60043d07efeb
SHA256

cea498f37d245fda4cb95e7816fe31992dd4c44094fb05af443b2d55637089e5
SHA512

61dfe376ae1c2ad4887b2fde6e76a2ef56020725c93772bae80302a03bcd2a159194f056f47a67306d7e89d22d0c116faca8a18b3af24b9bdb7d0657a96ee7ee
SSDEEP

49152:gMHRqn2VRXrhqJyijozvQYivtMUUAGp3cmZRED:gUw2VZrxiczoYivtMUUZcquD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DotaChanger.exe

Files

DotaChanger.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ