Dekont[.]bz | Triage

Sharing

General

Target

Dekont.bz
Size

559KB
MD5

80b4c893136cf9587393f85330d2eb5a
SHA1

148c977ac41cb9c91e8bdf4269a80e038ffee5ba
SHA256

05058845f830c184d8e97d779426424ffa31a10f48300f4716b55539db735813
SHA512

fc56e91b38d76719580954ffc1b356d956f1018025ae3a9065a8f05b7e0c29dcf7f6d674f5ce0436f587b2e2b14738a2593de7fee67131aa49dca55355024664
SSDEEP

12288:Bdy/vh31/8sk9upz8qfYfG7HvGgIatjFAvWjl7KzrBcyCWgSBoUnQMfnlvFAvos:BdynhFUjy8q8mZjGv8KzrBzh5TDlv2vT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Dekont.exe

Files

Dekont.bz
.rar
Dekont.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

doLi.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 728KB - Virtual size: 728KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ