a652ae5a304b0e78a630dc271f6272301557f447fb31ce35f567089a8610ee05 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a652ae5a304b0e78a630dc271f6272301557f447fb31ce35f567089a8610ee05
Size

13.4MB
MD5

8a5cff4bb98d125ef8a670aeb7326030
SHA1

029c6a036649628511787e82b03b99704e3d4028
SHA256

a652ae5a304b0e78a630dc271f6272301557f447fb31ce35f567089a8610ee05
SHA512

d6ef3f9231948a907a7686e2c396eef7fda7ca116eef6e56713f9f84e5f1ee1a679b1de1bf315c362c253823083105108a469619c33b7ba96b5c2a74b1cd5251
SSDEEP

393216:3Q+zEvkMZ+KU9Amv/HEyqhNg94ajY64CQx:3Qe8Z+KU9v/HsOHY6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a652ae5a304b0e78a630dc271f6272301557f447fb31ce35f567089a8610ee05

Files

a652ae5a304b0e78a630dc271f6272301557f447fb31ce35f567089a8610ee05
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\china\2200\Client\Release_China\Client.pdb

Sections

.text
Size: 6.9MB - Virtual size: 6.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 118KB - Virtual size: 62.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.IIDKing
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.enigma1
Size: 4.9MB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.enigma2
Size: 284KB - Virtual size: 284KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE