SAS çıktı[.]PDF[.]exe | Triage

Sharing

General

Target

SAS çıktı.PDF.exe
Size

933KB
MD5

74e9f18932ebc462d428a7cee4821ccf
SHA1

f96e06beb0b2957ee52cf5be29aec90d4ee80d33
SHA256

affac8911a6ad3fa6e5610b23f40cf20bc2990530af0693143e78f9573796770
SHA512

60471dd42392176703fcf5a8547d662e5dfe4b3cf562692e26369d50e4459e93a7335346464bc1801f8d425f0e6ebb5e8def5d4eefc49ce90fbbd280365236a5
SSDEEP

6144:mewSjRoWEzN9aEZl4W8f9lfh2bXg7qluaADIGU5p4awQkdT7dQh0HZcvuuJ/xfRZ:mexj25aNh4r9/p45Q5W3RB1pMR0PcL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SAS çıktı.PDF.exe

Files

SAS çıktı.PDF.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 930KB - Virtual size: 930KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ