SS free temp[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

SS free temp.exe
Size

557KB
MD5

8688ca737262e115ff06e43fcc3b6e85
SHA1

b5e5302042206f68b095395a6f148351c22dc909
SHA256

677ca8891a1e7e58b7a6ae5b58aac092cf803409916a31ad68f4a7f3996d7457
SHA512

4f563ce03e086bad7a3f8eeee6357ff476fc966b5bd8ac71ba9543102e27d17912d0228f5081589cc19c45afeb12e55abbfd1f7ede92ac2eb99298b2c1564d75
SSDEEP

3072:PLVw6HOf0sUYGFp4QOj0yWLisZPbhJn5bYTD0d0LvxFA0L1xF9+qY:D6Zf0bhFutjyLis1dDwD0gxF/xFgq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SS free temp.exe

Files

SS free temp.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

^^{ P#1[
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

^^{ P#1[
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 445KB - Virtual size: 445KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

ohtyeFrZ
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ