NewInst[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NewInst.exe
Size

277KB
MD5

c2e7e93d02fa7cba953e3dd4463ba91b
SHA1

ff908dd3556d49e45b2ef917f441a0035ac5aa97
SHA256

4e62b2ec1f99fbfaab9b6a9253da40e00d4e5bf9cbecb29e6e77284af424d0d8
SHA512

5b6032cfb3301e4aea7b5d2ee2b3c2474e9bb8a37a250359cdcc4c122deb7208fb9f5479afbdc3bb562832737f390fe59b434823cfac9afb949b52dbea43c350
SSDEEP

6144:W9MGS9lvYrQ4ShmWBl4ei3oY6ASC/5LQsmA9sWLnQFWTM/mlZHf2fdp18y:ml+vfTByei3b6A1QhAycTcvj18y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NewInst.exe

Files

NewInst.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\muwoybn6mesz4\obj\Re\ease\ppZ.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 275KB - Virtual size: 274KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 578B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ