ゴーストロック[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ゴーストロック.exe
Size

1.6MB
MD5

f1499a9e3f1c39c1cd38e1686c6c396e
SHA1

91d471ef8a186d0c2a67e57c955fdc8d9eeab604
SHA256

b81667854974b36ece05c4779f356dbc9f332b0aea3a524efdb98dc15f10fc88
SHA512

23a2d157b9f8279fe35661497706746fb7f6258c5e1ccd9213a8861267df06d1f1b94a64d68a6239379bebd607c78dc054ebe616cc5dae3f391d63d636c91057
SSDEEP

49152:Sb/gUlz7chwGu8RXWxfLfVYY0Us9diyRXXVqPUqa:Sb4UShwG4xzfVhNsbtFq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ゴーストロック.exe

Files

ゴーストロック.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\damia_de0etcp\Desktop\MainRansome\obj\Debug\ゴーストロック.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ