HalfSwordModInstaller[.]exe-3-0-4-1714528191[.]exe | Triage

Sharing

General

Target

HalfSwordModInstaller.exe-3-0-4-1714528191.exe
Size

392KB
MD5

2d520f0583cbd73d528074c11df20d79
SHA1

e0e00baf67f484e16d24beb75bc6290cff54fd8a
SHA256

3c32a1b0e405f72923392b87217b60897cfce314151930464a494100aac8d410
SHA512

111c74ffaaf559559851e4525bc5fe2d0deb3c768c0a2c0862c31adcbde0e3375aa40b11f0e871ecd2233642863bb10f27ffecce64ef7875336811ec14088dc5
SSDEEP

3072:JZZwzOrfEU4lus6lS1PQaUHkjhXaUHkjhlQdo0WRzJWrUHkjhR:JZZwzOrfMlHQXoXuQdczIC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
HalfSwordModInstaller.exe-3-0-4-1714528191.exe

Files

HalfSwordModInstaller.exe-3-0-4-1714528191.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\HalfSwordModInstaller\HalfSwordModInstaller\obj\Release\HalfSwordModInstaller.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 283KB - Virtual size: 282KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ