WinRa1n1[.]1[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

WinRa1n1.1.exe
Size

117.5MB
MD5

4f017fc337f6c718d2464ad51b575979
SHA1

ce15e3ab77f622af40347d7b88e016722d95c735
SHA256

628362e1925ac24ee6395460bf145ee854160b2e3bbb2236b2e08c5680b70296
SHA512

3ebaf99e96accb7db327644b97d20d7c158e0084489a0b854a9513b9b4a6a4adf3cd9321a0e97913d20124ee07c2e5e4a3849162e886872a3cd3af695a0bfa4a
SSDEEP

3145728:M3zKJKgzwZnaeJi9oPosFi6uq6zh8BuluC0/Jls8t:XwzZanoPTFi6H6eD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WinRa1n1.1.exe

Files

WinRa1n1.1.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 58.3MB - Virtual size: 58.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.x9r
Size: 58.7MB - Virtual size: 58.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.Wy=
Size: 424KB - Virtual size: 424KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ