ChangeMac[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ChangeMac.exe
Size

26KB
MD5

870b09a0cc7f8918d3b387963e57bf1f
SHA1

a7ea2189aca66f0acf77e2732e3abf5295882d2d
SHA256

35a0ecefc001f72945c9594ef1d467d0ddc4eddcec6991d423ac2b6084a53846
SHA512

67c655ca8ac100a31ffeed2f05ad0fbdcede026f8016bf57191513af133d6e6b7b4a17b1c5c7af9f897010cd1053b2b0b0ddc4647b86c14b2d69b6bb0ce0674a
SSDEEP

384:87Jo2hYvWMUMol8ueZVg48GHwRHCHG6djVj94OV8y/6MTW4g1CwL1lb+/iGJTiD6:fEHP8jpKOV8ySM41v1lbV1Dgm3HrdM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ChangeMac.exe

Files

ChangeMac.exe
.exe .ps1 windows:4 windows x86 arch:x86 polyglot

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ