dfbeba838a8f0ab768d8ee8c1f06294e3d69670d187b3244614669f95c86b12a | Triage

Sharing

General

Target

dfbeba838a8f0ab768d8ee8c1f06294e3d69670d187b3244614669f95c86b12a
Size

619KB
MD5

e54d15648bb7f2421543dc51d5360b2a
SHA1

d6846c36a5760f4e4adebb14dbd970e30daa0502
SHA256

dfbeba838a8f0ab768d8ee8c1f06294e3d69670d187b3244614669f95c86b12a
SHA512

411ea7f09c8086117abaa28000ae15d1a52070d7ac3ee76604860ee2db5695873cf74ec6ec571ed9adb11f953ad5e0a60c33d3dffb7710381348c3cd42c5972d
SSDEEP

12288:93lFzMDX6+ULPd4JZW4u9R573Qewc7j3fQFXfnT7kcPZp9+3KzN74ASxZQY7bxq:BXIDXRG4Gb5LL7jyTRg4NcAE/q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/GH987667890000.cmd

Files

dfbeba838a8f0ab768d8ee8c1f06294e3d69670d187b3244614669f95c86b12a
.zip
GH987667890000.cmd
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

CxTf.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 785KB - Virtual size: 785KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ