HanwhaSystems[.]GS[.]IRPS[.]PMS[.]Processor[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

HanwhaSystems.GS.IRPS.PMS.Processor.exe
Size

6KB
MD5

37ca2f7f284d8243567178f770b3919c
SHA1

8bcf0cf0f52d19d75067523697e82af7c75fd356
SHA256

311fb3e4923760fed684a67a59cbf6a475354cac6045360eb11c1925390e96c2
SHA512

e7125dd171fd29e5ba790d11f87dd0607c9a0bfa68fcd12f0a14cc94daa3a49025437baaa558bd1652bc2e12864e5eaa1a4482c0610f5326f43a90400f78f116
SSDEEP

96:76OONYwPFUlv1KUCLFgpv+ahmuQrVsNnBIyRep546TezNt:7gCGUlQUC0v+ahmuQrVsNBIyMH46T4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
HanwhaSystems.GS.IRPS.PMS.Processor.exe

Files

HanwhaSystems.GS.IRPS.PMS.Processor.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\Workspace\Projects\COSMOS\Solution\src\IRPS\PMS\Application\HanwhaSystems.GS.IRPS.PMS.Processor\obj\Debug\HanwhaSystems.GS.IRPS.PMS.Processor.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ