scheffer order N[.] F1676[.]24[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

scheffer order N. F1676.24.exe
Size

770KB
MD5

19393eb42b1b98ba670d76a15d9036e5
SHA1

ad3c287d9ddc8674fd9ab44943b5fb6782e37dfa
SHA256

5f5c4bb7e4fffd43a0b048e325a83318a85cd0f5487d0be34fad70500036de20
SHA512

ee0f20e6704950f85de58027f454e343414190368fdb7445ce34fc42265b80e513532c905b3d56b910c3cf7fee3796330103d6b06c3bea7976b3fb0178dfcda1
SSDEEP

12288:gD965pwC3Jc10bVLG3FVR/Z60Mg131EIlABXRz8sGNQl+y4NzeQh2Xp:gDg51G/R/ZVFEXRz8sT0dzePXp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
scheffer order N. F1676.24.exe

Files

scheffer order N. F1676.24.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

QucH.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 767KB - Virtual size: 767KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ