Cloudware[.]exe | Triage

Sharing

General

Target

Cloudware.exe
Size

297KB
MD5

0bf0db39b67c5e2c2568032644fb3b19
SHA1

f37d67f69a49413c445fba5d5f856c01838fa47b
SHA256

9e734987ac3f35994c15a092409087db7de9fb312d6f557c7f485a856e083fed
SHA512

82bf0626515458cd1a39db870f7c73011060b50d12f26fb696b6cfd4d55f9c30cf7c13e59d57c4c537f1b22fbbc49eb46a32134f473ad85802b5fb443cee58e3
SSDEEP

6144:0lqrZuknt47WpkGXgTyObsHTTxF4wA7Se5ipWLZ0MLdcFCdYvJyL28yi0uuhb9jw:27smszTxF4wA9hLZViQYvJs28yVuuhbG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Cloudware.exe

Files

Cloudware.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 293KB - Virtual size: 292KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ