WH-Rat-setup1[.]3[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

WH-Rat-setup1.3.exe
Size

64.1MB
MD5

f774977fb2b97109fa24ffbbf19be50d
SHA1

386e00240cfff8d16adb258d4053be005401d81b
SHA256

cda56d8b2c69d9229f2ee883a093030c2a6df419e958b87082a62e85ec1fcdbe
SHA512

02b5f5a3884e1bdf526e8ffe92f46ff41b6252fb570019e27b09506d23ae0a91f1ae9cdcde8090d35c4331a6847cccf97e0580126c70aa5b30a506c86b1decc3
SSDEEP

1572864:az9Fqb/jHsD80AVDybh2LcoDbQe6dyKxKur6t:azjqb/Y9bh20sc6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WH-Rat-setup1.3.exe

Files

WH-Rat-setup1.3.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\MY-PROJECT\WH-RAT\Source\WH-DroidSpy v1\WH-DroidSpy v1setup\WH Rat ims setup\WH Rat setup\obj\Release\WH Rat setup.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 64.1MB - Virtual size: 64.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ