c1bf379cb8e9d4db5349d0cd8cff2010N[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c1bf379cb8e9d4db5349d0cd8cff2010N.exe
Size

16KB
MD5

c1bf379cb8e9d4db5349d0cd8cff2010
SHA1

dc42bad01f1f4a54f82a1a2ffd5867d5011a08c6
SHA256

3feedc38a8f40bc5483c1d68a7e8348e13083738f6a4c252013e92b6fb5a0e5d
SHA512

357720e36e29209557960696a02eebbe22ad181e1aa54181374ae3e61c2bfc5ee4ff1be74e9751870c7ac64b65291c9c90f59009e9b4ad52e28efa75a08a0362
SSDEEP

384:VKFtzlX8krEmzg6aeiCDSNUr2D/M0WDXYx:YFtBlEm4avaD/M9y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c1bf379cb8e9d4db5349d0cd8cff2010N.exe

Files

c1bf379cb8e9d4db5349d0cd8cff2010N.exe
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\TFS\github.com\AdmPwd\Main\AdmPwd.Utils\obj\Release\AdmPwd.Utils.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 996B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ