RiskStealer[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

RiskStealer.exe
Size

4.8MB
MD5

1e257a7667319a6b83472bc9fff24e57
SHA1

0781b221d004f2664511a905f9c2f7061cadae5f
SHA256

cfaaea8cf9a9fb216eb23f7c36893caa00d657a9cd7748be3c01da1f6db6e5c1
SHA512

a3a482fc61429ccc90a49dcd365eceb45629390714ba202395d0b73e0dc979acef1cf9a4941c57bb5e9359ddc0e02a3b2e22d18b8de93532496c3b48935ffaaa
SSDEEP

98304:fkjozJ9/im8XVBKl6tmJVP2sRx/E0T7zN3HtHVEjdGSNIT4bNJFY3Oqt2SGuA+i8:nzJpjS346tmJ1ds+7ptHSjBHYm9uAm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RiskStealer.exe

Files

RiskStealer.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\DisplayName\Desktop\‎\Solutions\Stealer\LocalHostTools\obj\Release\RiskStealer.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 4.8MB - Virtual size: 4.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ