衎啁癔ᕏ[.]ato[.]vmp[.]exe | Triage

Sharing

General

Target

衎啁癔ᕏ.ato.vmp.exe
Size

867KB
MD5

966b65bc10a05de546e1154dd241c28f
SHA1

d6466a8a944c6358b5981d5f2881013d83799b0a
SHA256

364f58023f0ab84a78611cee731dcb38bc98ffc3772b46227a07a3d4c822e126
SHA512

81d0bf1e313d2859e8be487574be88af65a397b1d6247bdf27313d6924beeaec4add5950b391dd3f38caa3e09790f0e2d01ef05f098193314c8973a0e2c41f47
SSDEEP

24576:TcouQAy5fkKBPQlzYnzhj8wlq1pmvyKnB:TcouCPBPQlzYndowX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
衎啁癔ᕏ.ato.vmp.exe

Files

衎啁癔ᕏ.ato.vmp.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: - Virtual size: 381KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

./3k
Size: - Virtual size: 568KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.\0+
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

..SK
Size: 864KB - Virtual size: 863KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ