Einstein[.]lol[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Einstein.lol.exe
Size

4.5MB
MD5

b1456298680c05905f91cc2df103d20c
SHA1

5b90a0abf55221d63d7995d2b0c07fd449332fb9
SHA256

ebc5df4b272fce5b0bea5d2608987fee381c79f464f5d36df1db14aaba3fbabe
SHA512

21bd0ba588db4e7bebbc74a4cd84b9d03a2ebdb7c2f78cc5d19b3938aa878658b930763ac19b37aaecbab38ed1c6bf1a1b121a0dc43fe8a09894afe419de3281
SSDEEP

98304:nz+nGIrji8Z1woP5CgHLZotZV3cX8wKaJuDVNklrkIT4bNJFY3OqtXkqXf0FPAW:nzLIL8owptZV3cMzaJuD3vjBHYnkSI4W

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Einstein.lol.exe

Files

Einstein.lol.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Shit\Sebwett Virtualizer\Sebwett Virtualizer\Lava Rebrand\obj\Debug\Lava Rebrand.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 4.3MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 184KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ