Scan docs[.]exe | Triage

Sharing

General

Target

Scan docs.exe
Size

594KB
MD5

62fda9bddb8cf5a4b641de014e050653
SHA1

532bdadc95a530e10ed2f7e377f37018cfca6b0e
SHA256

63703694c54d43f82c63cb2f61964b693a73bcf6f013cda7e226d29a77d0c82b
SHA512

e1e71ec6589252b6f75c707c90c6115a0cc4b5515a56914a2e10a126b19ed4fda7bc6e3af0c43a96b63306ed82cc573a8a6118c3cc25b370adf3c632222a585e
SSDEEP

12288:1XOIWF8UKoZbJxNS6iod1/KNrxIvU2xp1lAlR6kCJVM0K:RWhxNBiMI5KvtqlR6kCJVTK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

Scan docs.exe

Files

Scan docs.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

wkBx.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 592KB - Virtual size: 591KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ