WhatsApp[.]exe | Triage

Sharing

General

Target

WhatsApp.exe
Size

286KB
MD5

c6eaf9209fe45bca87dc2ddba709ea98
SHA1

49d3a634e0ed9e49841edf899d8c9a673b98b5ff
SHA256

69783746ab4664b7e1a5590d9b589c921f6b760e4b75873928532a1330449119
SHA512

64a51721c6fe5f06955206043b2df5058261867e4f1a20d144bf9a2693c09d83c9d78ae66cf61f49d1bc8c965a4877fd0fb69555b8c623bd68f0f24e85667722
SSDEEP

384:MRtximmUjvQ/0Baxc8IcbUi+7AOQt6HMf82utc2NWszXpQT34aOe9sRS872UVTSh:MRtximmUjIiWMy34arSlay34abmn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WhatsApp.exe

Files

WhatsApp.exe
.exe windows:6 windows x64 arch:x64

f12299573f995fc0c70b04fabebb3e6c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

whatsapp

RHBinder__ShimExeMain

Sections

.rdata
Size: 512B - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 283KB - Virtual size: 283KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ