rSeptemberpayments[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

rSeptemberpayments.exe
Size

833KB
MD5

ff68effad5454a4d17e992c0000af021
SHA1

c046e6ee89ec35bdc8f219edcba871f8f7876bad
SHA256

afef519b2380d9483a1b51eaccf235593140a75641e5a469d130f2d48ffd5268
SHA512

d6b8a1370efcb58d0deff411363e2679cf35b294c6bafd668c5b77c7c15d5d8ded6803f63a5ecefb22bf60ea1be4afdbba5f8508ccb3ecc9a678152aa1af6357
SSDEEP

12288:s3MvmE07DtH8xrpoN/Dp586MV9Uq6D4+ETa+TSWsCdaVWjYu7N5:70mxFoN/NKMq6s+ETaYs8aVWMu7N

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rSeptemberpayments.exe

Files

rSeptemberpayments.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

hVEm.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 830KB - Virtual size: 829KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ