midnight[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

midnight.exe
Size

889KB
MD5

ce0228e2a753a6310aec035ab1ad629e
SHA1

f60210d309dbab3f8b18972e66178aaeb5dde4b9
SHA256

62739967b317458074a09555ceed2980d19e58dc4b781f8c3394dc642afec6f3
SHA512

baa3f74dc21478a577c7580a92e138a3974138dc91ffbd125d337a0dea507f44635031d5d431b437c7e55afd074ae87bf6d3524021717e771ba6a76b85c1e6aa
SSDEEP

3072:dT7WGbp3EsYCIkkFg8tvHH86GkB0j940yj0O/OwDpGJZVkwOSnKvt5/mbp3EsYCt:dCxvnvmuLXjDpGbjS1xvpJbov

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
midnight.exe

Files

midnight.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\yocha\source\GitHub\WinLocker\WinLocker\obj\Release\WinLocker.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 716KB - Virtual size: 716KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 171KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ