hehe server[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

hehe server.exe
Size

1.7MB
MD5

2156c127fc3cbb1aed87de2d26b9e57d
SHA1

9f93e5bc9c2ae83406f7f0fef8bf60af9a78cbf4
SHA256

06646f3c76139bb8f84e069a95cac5a5b1a1ffe28e1231f62cdc726660b85110
SHA512

3dd5be1eb9f613be930847c752c72fd86158fcd2675f59910a0a5f717254854f2697eb632bba059073f4a32b699170d20182a25af944225345b9eaca32440193
SSDEEP

49152:9+4yPRRGCvw2/986PIOolQMdoANAG5ayX82EZ:9+4mRF42/986PimaoACyX82

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
hehe server.exe

Files

hehe server.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\a\Orcus-1.9.1-src\Orcus-1.9.1-src\Orcus.Server.CommandLine\obj\Release\Orcus.Server.CommandLine.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ