f02b38367e707fc3723dbb4c783746ebf4b3180377109ae704adc9b48b84936a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f02b38367e707fc3723dbb4c783746ebf4b3180377109ae704adc9b48b84936a
Size

698KB
MD5

b0b79ee718540ee34e0902706bff3169
SHA1

7f4a96eb5ab6fb6e2dacf62d2356120bc63819db
SHA256

f02b38367e707fc3723dbb4c783746ebf4b3180377109ae704adc9b48b84936a
SHA512

19b540b66b69d12e10f7a62d652979be4031df38a13ffaa744a69c8353deb49ea3d3ed86d3739ed3af7a4690fb13f8d99006a3424406d4a1803c9a3c047f12d5
SSDEEP

12288:VM/FMOqm3Z42QK1dYjtEbzMEhxL0ME4E7P1f:AJ4idYZExEo8PN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f02b38367e707fc3723dbb4c783746ebf4b3180377109ae704adc9b48b84936a

Files

f02b38367e707fc3723dbb4c783746ebf4b3180377109ae704adc9b48b84936a
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\User\Desktop\Tooling\Seatbelt-master\Seatbelt\obj\Release\Out\HocusPocus.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 696KB - Virtual size: 695KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ