X-Aviation[.]rar | Triage

Sharing

General

Target

X-Aviation.rar
Size

180KB
MD5

80a688d51bac7054fd711fe8001df55b
SHA1

0fae54c1b3664334393bf3c3f1933ad40b77e997
SHA256

1e4d629630010de9d5ce2c48b1462a15eba3c8eb3ea152e56d42b3a58e50e37c
SHA512

e2210dd8515c52d836854f711e5ce3b9a659cd5c6436fe122323e53a778aca3b6aa00da36cfdf67ad541cc1882105413a334094b33c2002034b977964bbe12ff
SSDEEP

3072:7N9YVFeQjsI1VKGBojB+OT6dccWFEaON+Nafy2NiJvDRHX1OtIwtpxnevydySwK3:zYVFPjruGE+OOdWFE302NOX1QIinmydr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/X-Aviation/xaLicenseGenerator.exe

Files

X-Aviation.rar
.rar
X-Aviation/license_db.bin
X-Aviation/xaLicenseGenerator.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 162KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 287KB - Virtual size: 286KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
X-Aviation/xaLicenseGenerator.xml