Thomas[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Thomas.exe
Size

1.6MB
MD5

095be020902727507930271895545dc6
SHA1

82a39e3db38c724cfa0a79df3d1a239372a78d4e
SHA256

d8bc7a1b89ec0465ea096d200b4ee5f63d1b9ddb1ba5799b1686552ae297a242
SHA512

8a5416880af50873e72733e0af40ec20ca9ac3679388d07d218f51db12c592b514d08dd517667d593f593b27c3b231ffea99ffffd586e6a6088d786c867bf9b0
SSDEEP

49152:u0LaWEQsogC2vIT+qDceUgozk1c+5LASBzmf:u0LaWxxwPd16Hz0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Thomas.exe

Files

Thomas.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\COMPUS.COM.UA\source\repos\Thomas\Thomas\obj\Debug\Thomas.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ