ef0fbff40105e86977818971d61a02ba0fd071cd2a6abea0a2d8427ce689c993N | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ef0fbff40105e86977818971d61a02ba0fd071cd2a6abea0a2d8427ce689c993N
Size

5.4MB
MD5

a7af71e97597454c2b72dc1b84ab8910
SHA1

29bcaf64969c37ddcec6e039df03b7c11688344c
SHA256

ef0fbff40105e86977818971d61a02ba0fd071cd2a6abea0a2d8427ce689c993
SHA512

89973d9ebadd1d7bd7afd5aa76b3b8ca8f2cf6fd24955e7008250abef78200ffd4ec5fbc92671e6824e210e069eeec53c0dd0b72b65872390bd9fe396798f1e7
SSDEEP

49152:ClmJljo+V8tgJd8lhKPgssSt2gZXODBMO+YrovpU/99qnstLet3Ly4cY/+:ClmA+Cgalhv7StFOg4qnstLEe7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ef0fbff40105e86977818971d61a02ba0fd071cd2a6abea0a2d8427ce689c993N

Files

ef0fbff40105e86977818971d61a02ba0fd071cd2a6abea0a2d8427ce689c993N
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

FAXPATCH.pdb

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ