5c0bb9f93987d920b83276168f29ef40N[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5c0bb9f93987d920b83276168f29ef40N.exe
Size

2.1MB
MD5

5c0bb9f93987d920b83276168f29ef40
SHA1

56bf4a7b86775563b5a11011701793253b967e6d
SHA256

ff7a8a62081e1d01eee8f45d7e4c358cee8a91ac265f9613c16a352865988529
SHA512

ffb15e5e767be1c92bc6479074ef4e2c5470b0af497fb3c90deae5a0d9f62891b4c11892587de1563318fcb42054e59cda76993d678ebb658bd5e9624154f933
SSDEEP

49152:yIiIxIiIsC55ArRokp9oJdXN0BMOwLloBrug:K2rRok8JdXN0B7+s

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5c0bb9f93987d920b83276168f29ef40N.exe

Files

5c0bb9f93987d920b83276168f29ef40N.exe
.exe windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

F:\Office\Target\x64\ship\postc2r\x-none\appsharinghookcontroller.pdb

Sections

.text
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.c2r
Size: 512B - Virtual size: 256B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ