2024-09-25_ebb200eea9df4e28343cbe48b5e04c51_kaiji_poet-rat_snatch | Triage

Sharing

General

Target

2024-09-25_ebb200eea9df4e28343cbe48b5e04c51_kaiji_poet-rat_snatch
Size

5.1MB
MD5

ebb200eea9df4e28343cbe48b5e04c51
SHA1

993ab8051fa9b194e2690aa24ec84e31c91a35ae
SHA256

3fdb118452bb00c26040ca82202a7c80c2ff0dc5c7b6820f5820d0e643cdbcbd
SHA512

e021946d199f24e573483e3cfade18a47ad98a22ed7b3d9e50b72426c257c61bb65677672ead714781d244578cc03ced09b500b7d28527d8894612e33fe789d5
SSDEEP

49152:Mg3kXf3pgz/SsMcO1fZkKLy1zpslsqzzqqALm9axp6XgcBr+wp7Cf4KGuT+X1q7e:Mg3kXPyeLcQzzqqALm9HlrI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-09-25_ebb200eea9df4e28343cbe48b5e04c51_kaiji_poet-rat_snatch

Files

2024-09-25_ebb200eea9df4e28343cbe48b5e04c51_kaiji_poet-rat_snatch
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 215KB - Virtual size: 436KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 988B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 110KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.symtab
Size: 512B - Virtual size: 4B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 432B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ