PEV[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

PEV.exe
Size

250KB
MD5

f042ee4c8d66248d9b86dcf52abae416
SHA1

4cd785c7c3e40c42e3d126086d986c4d4d940bb2
SHA256

ae0f5cc54e4b133df66a54572a7ce52faff11f8fd0caeab088aad3699d6ec924
SHA512

a8a5f1191dfa212e029c79f1e44866513c29b54a3ec25fd4badc65c80e65dafe7194a4ab597bd14d33bfd077dd8d58c07f29aeb2eed1ba8a065d3a4ad165340d
SSDEEP

6144:BaBVLMUCBf3Aeh6kzH1fb0TlmDkG5gXzVw:BMVAUCB/A46kzH9qG8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PEV.exe

Files

PEV.exe
.exe windows:5 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Sections

.text
Size: 244KB - Virtual size: 824KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE