ClientNonevclid[.]exe | Triage

Sharing

General

Target

ClientNonevclid.exe
Size

75KB
MD5

6dd3e14db8d2e3cd3200c062d30ae97a
SHA1

4f4d968dab2cfc95e7aebb004421ecac1eac34df
SHA256

b5c8b201846ef3b548ad18607ffb482302b2570c15842477fe71b0a564e31e3b
SHA512

3a69bcdefabaf4418816b6fa8ae90d28a3893b01a73d7478d9c0e43ffa3de9a250b5731dc042a3453ce806601ee8f5e1aa6cff9b63c742e20314201858a5e8f4
SSDEEP

1536:d0kYa1ez0MoSzaUwSyJSbeLvc6OfcHktpqKmY7:d0+1eQMoqwJSbe/yj2z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ClientNonevclid.exe

Files

ClientNonevclid.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ