accountchange[.]exe | Triage

Sharing

General

Target

accountchange.exe
Size

627KB
MD5

c4f8790ec53d25c9271bca94d3e7553a
SHA1

338c8a2adbd812faf45c84ee210993e3f1f9b397
SHA256

56066ae5481c334937483dd0ee1874d44c97b87263bd7d81e6afc414afb6363a
SHA512

f0ebfa9eb5f43a5d31296b52efd5125d4ddd6cbbe7954a37627ac7276a0cd8c62bd4f1a8506f13378ab690a82a55611285874d1e4d8fbb01c96ef4d4c6db6ca9
SSDEEP

6144:0Jq4RxgfaROQNz/CSuMurpwcaZwhrQlWa4WMnrOopoTIROYh5oElpkUgIQIasq26:E3zgfi7z/CSb7N8nCsoes1YLqGmtYa9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
accountchange.exe

Files

accountchange.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\Auscar\Documents\Programming\projects\elysianwlc\elysianwlc\bin\Release\accountchange.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 624KB - Virtual size: 624KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ