Legion[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Legion.exe
Size

1.9MB
MD5

688ee4ecf863e61e62fc9a3337bea3b3
SHA1

8d62ffbefebd053d528f43a154c649bad1524f23
SHA256

700c940e3ace48e1f51144d916d0786d67de9f60444a673db382f006f4fab5a4
SHA512

2c98d898128550beaa05be0fb4cdcfaa94a270f9eef9e6e9614b3cf32bd2cfcac73d41caeb059caacc54bdb3143b2233c161dceb403a0f1ea03a0136889e2e37
SSDEEP

49152:/xrpjgFF6lTat/WoQAFRNJ7W0xnXpcdwwTDWgd0RIj:/AXdW1ORNZWcnXE9fFW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Legion.exe

Files

Legion.exe
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\briwo\source\repos\Legion\Legion\obj\x64\Debug\Legion.pdb

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ