Obfuscator_Protect[.]exe | Triage

Sharing

General

Target

Obfuscator_Protect.exe
Size

865KB
MD5

0e84270e68fce7427e36d0ccb6275049
SHA1

d1a033dca615edae8db23a3b4254e2c23aa1e351
SHA256

9a7c85e8af41e582676fc6dcb7ac6baa59b16738aa2790af8566ed4ee4bbace5
SHA512

3950b774c0b6d23e9c89b8a43defe20baa80d905f9d093d9a9adee53a613f6ae59266215089b309eeefb372d39b76e49e3497a4152f0d7ade9573416be3954a0
SSDEEP

6144:laSTXvfisggkyi2xMUE/xugWfipggkyi2xMUE:7G1ghi2Cp9aghi2C

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Obfuscator_Protect.exe

Files

Obfuscator_Protect.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Py_Dev\Desktop\RAT\Obfuscator_Protect\Obfuscator_Protect\obj\Release\Obfuscator_Protect.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 440KB - Virtual size: 439KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 424KB - Virtual size: 424KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ