Broque Ramdisk PRO[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Broque Ramdisk PRO.exe
Size

15.3MB
MD5

63b027671ac80b7edaf8d866eb05cba9
SHA1

b3445b4a134ee72ffa74293bee9010f37341485c
SHA256

4f6a5b6cf4b8a227e7c98f184d2f7a1c40813f5dfd06d7e67fa391518ea4507e
SHA512

7ad94d58641cf6e011392eb4bb8a33cd290e213d9e1c7a47743b70d19448de50b3c58e097d92186559341d6f9e2948bce48c68ff154f83b8bd91b3e9cf12a476
SSDEEP

393216:k/RNT5/61sduplmTTruq7NXzh3hHlO98CIbwxay1:oNT961sdupc7Nzllls8CIbL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Broque Ramdisk PRO.exe

Files

Broque Ramdisk PRO.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: - Virtual size: 8.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

./}M
Size: - Virtual size: 192KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.&Ks
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pQ\
Size: 15.2MB - Virtual size: 15.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 138KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ