ih[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ih.exe
Size

558KB
MD5

2e260243d8475c8703b2dc2fe651a3cc
SHA1

76fc888920b75f5dc41712de05d507f0a26f1083
SHA256

312859425067198e57ac05141d170e63ca7e0a46eb0fecdc71e6d68b76eaef36
SHA512

2ce55c9043b373c902834c5f18c0780399d77dd6b3bfd65d89ac0f23c853b01e8186163650da7cdbbdbd440d8ad55bc69c413e4d6a2429e2c17754a3298e3e82
SSDEEP

12288:oIN6lM6+KoktxqEwUxSmBHseNJvvAZKIa:JqJtH3q3UxSmBHsaFvAs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ih.exe

Files

ih.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 556KB - Virtual size: 555KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ