TrainVisionXMLMaker[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

TrainVisionXMLMaker.exe
Size

107KB
MD5

8361c3839aa8834040068143e00da548
SHA1

2ba5e4a41e9108a0f7973e200515e13394df75d4
SHA256

dfc09eea56c25d1ffa388b8518b5780f013dca2540f70ef889a9c5ee04dd4440
SHA512

973a1f768fd93ece22cefa2be64330cbaf4fbd8d14794c61fe7dca97e3dcf3182b9b0eb2afd6b03aa7eda9e7f54819fa2ced77f4be2cb6c83aa3e2cfb39aeef0
SSDEEP

1536:S443XQlR/ElTy/efAk3fhoi62hfmQSgaK657isH7UGhSUsU4Vlm2Mq2U2lNE:rGKWfAS5oi66f/avOmW2U2M

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TrainVisionXMLMaker.exe

Files

TrainVisionXMLMaker.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\Visual Studio 2013\TrainVisionXMLMaker\TrainVisionXMLMaker\obj\Release\TrainVisionXMLMaker.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ