NHSE[.]WinForms[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NHSE.WinForms.exe
Size

714KB
MD5

cea12f45c57a0679e7ad77fabe890856
SHA1

8497fb0e3bf087809a70520eef32cda22e660b92
SHA256

15c90b022c95abccc549fac373b48f9a280f236fde243f3164abed59dabe0969
SHA512

b66e4ab1a34b12ea7369205ae9b2fcb4d9f12c82bddc560bb563022f430649d290bf7c654c89316fbf9ed5fecdff4aac7b1cd4b4193804d7f53719868735eb42
SSDEEP

12288:dnKqK9pmJB/m0z6QFxlXn5eWoxWN2tSBZAjTBoqFjaOtnWeQpjD559pC:vwWNMlFja1eQpjD559

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NHSE.WinForms.exe

Files

NHSE.WinForms.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\1\s\NHSE.WinForms\obj\Release\net46\NHSE.WinForms.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 602KB - Virtual size: 602KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 111KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ