ag[.]exe | Triage

Sharing

General

Target

ag.exe
Size

1.7MB
MD5

0af59f64fcc71bbc6f281a5e6af33f4d
SHA1

123af85c804b165bcbb98b6bed2ff81464226198
SHA256

2ec62683b64aa7fa39be4d48318d12594baca408c38d7a664ca201dfdd410771
SHA512

5d813b9e30b5f5914ee2833ae6c561353cd5c6fdabc865c2786cf39b38c38fdb59d5574fc7639a9c6b9f735afd89ff7654991bd21ffcbec3420b37d3c54da6b0
SSDEEP

24576:9/GPoGyO22JW8FF85GppNO+nP/2xkqjo5E1wrqlUINrQ609RAbcvJtb7YemdVnkd:1WysKG4+n3Okq31tU6rmlrvIfk+an

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ag.exe

Files

ag.exe
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Administrator\Desktop\StoppedBypass\ag\obj\x64\Release\ag.pdb

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ