2e0910ab244ac764dec9e4dbd7a73a63865fb6ed730d5d0c3dfc1e416167cb03 | Triage

Sharing

General

Target

2e0910ab244ac764dec9e4dbd7a73a63865fb6ed730d5d0c3dfc1e416167cb03
Size

1.9MB
MD5

87999c1cc24a7993f1f889ee919683b0
SHA1

bad0304737fd2c2639a8869a22a544fbf3eb9bd7
SHA256

2e0910ab244ac764dec9e4dbd7a73a63865fb6ed730d5d0c3dfc1e416167cb03
SHA512

000e7a1dfc96859ece193b6b992a746961cd5606e7487b6d8e77ff775d0fc5d10d0a7614e1195199f1adfc0897c47cb3d8fdb979aa77f3440016904a17f6c78f
SSDEEP

49152:bxl8U9+tiqfBHwBXgTST+MdDHc/EBRXX7UA/a0w7M:ll8++NwBXggnDHc/EzZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2e0910ab244ac764dec9e4dbd7a73a63865fb6ed730d5d0c3dfc1e416167cb03

Files

2e0910ab244ac764dec9e4dbd7a73a63865fb6ed730d5d0c3dfc1e416167cb03
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\officeappguardwin32.pdb

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 334KB - Virtual size: 334KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 78KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.c2r
Size: 512B - Virtual size: 420B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 196KB - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 83KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ