replaceparser[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

replaceparser.exe
Size

27KB
MD5

4d1bc5e8023b5862811934031e644a7f
SHA1

2f63e5efbedab17cf38df328072c442ee180eccf
SHA256

c22cffc760672fccb6b67d3c9b2d49b8a3b0e04d7ddb5858aa0f5833cd53c4a3
SHA512

d06fc09a1a121270ce1d72f88da5b70907ee260dfe8d1b01411de0cfab7cea54a32524cdb407b61ffdca3698de6e69bc444a17453957a13f6201f834ccbe54cd
SSDEEP

768:p1PeoeylxjIyAP2e0Ob9Kp7BLT3REiPUs5/:1lxEl9KpMiMe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
replaceparser.exe

Files

replaceparser.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\Users\JournalParser-main\obj\Release\ConsoleApp14.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ