ArmDot Trial Bypass[.]exe | Triage

Sharing

General

Target

ArmDot Trial Bypass.exe
Size

6KB
MD5

ae06fd4cde97f7bfa287ee3a3760ca18
SHA1

5eb1bf23168ba22e04d051c64f76d6ac8ce2c2b9
SHA256

44603ac8b9cfa164c77c3d97cab92f890b466514d14e94b516a6b903859d0f41
SHA512

629d7bfc1c5c5ede975dde3978fcde8497e21d09b7ab6006e96ec044bf8fc4590c63c38653253c7cc7242ecb4067efd134f7bfd593d2747eddcad802dd37d703
SSDEEP

96:eZfne+rWhsa0emt/XfwZsYC/uyTB7uHKRXRCtGzNt:IfnOsaHmhXf+CX1SKD0A

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ArmDot Trial Bypass.exe

Files

ArmDot Trial Bypass.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\slle\Desktop\ArmDot Trial Remover\obj\Debug\ArmDotTrialRemover.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ