daemon[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

daemon.exe
Size

100KB
MD5

bf66b3856f56eda60607a30629937b80
SHA1

99424c091e98e2ed62fc39825c5f77dfb7955a4d
SHA256

e760f3883269592ec6af333b6f2f187ca09862aed2e2a6ca9d1075a206d3ed08
SHA512

936d41698034e84d0095d83825946ed6d1925779264520ba37f76fa423917fb3b7ad3deb24bc3faac58d8d96c17370f580b9cfd77dcd65dc377a54c9cb8e92b3
SSDEEP

1536:RkJIalOYktfCM83v6pq9UVE/kGE5+Kb+LwoMSJZNx5FO/dbe:QlITtfCMT2UVE/kOXMSJZDPO/db

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
daemon.exe

Files

daemon.exe
.exe windows:4 windows x64 arch:x64

Password: y3q5rvfasc fc34grv3rrgf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.text
Size: 94KB - Virtual size: 93KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 54B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 236B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ