Robso[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Robso.exe
Size

406KB
MD5

8f4ec9ecba55b7bd9fbed47f1addaaf7
SHA1

9165fb7425531252d5cffcb1a1811a7822b253a3
SHA256

7b96d539c7ffcfcbf730dacf308f579f76826f4f3798d360c52719fc94b5eb51
SHA512

9291384de150a42f162aefe0577ed47fa122e926af87596d186d5e41455f0817f38d0224f5de1b97be8c285c83ad7c2d9ed51875b2d18fcb919990fccd18aa0d
SSDEEP

6144:tUHhUO+gOe6VlWT8b9fGCCPIHkn01GMbdUtRynbbkl:t+OPVle8lGCCIp1GBvyUl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Robso.exe

Files

Robso.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 403KB - Virtual size: 403KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ