Forever21 Perm[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Forever21 Perm.exe
Size

2.6MB
MD5

a0d81e8727c51974bf0be2a4dad9639c
SHA1

29aafb4086fced2bf425cf704bc31a355502904d
SHA256

5d3839ad6d433e481ac685b5ac0ec241842148b2c27735ae582c99f2eaf500fd
SHA512

4a7fe6856c93bfad81b252579d997da69c1dbf730c55871f93b22cdf39193ed4dc1046d371a2b88e501b5e2a3be5b4eda40331c6d85e36063705786136552deb
SSDEEP

49152:f9/QTNw2mITYbNbNWo4kSH3OqtwIfrgBWBKH8jkDVFCNXODzWS9HfX0HWNk86QvN:1/EMIT4bNJFY3OqtY+KH4kpc+DX/0HYb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Forever21 Perm.exe

Files

Forever21 Perm.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\astro\Documents\Astrafn source\Spoofer\obj\Release\Forever21 Perm.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 237KB - Virtual size: 237KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ