Recovery[.]exe | Triage

Resubmissions

19-11-2024 17:09

241119-vn7sxsydpa 10

19-11-2024 03:18

241119-dtmlhazapb 10

19-11-2024 03:11

241119-dp3f6azgpp 10

19-11-2024 03:07

241119-dmstyazgnj 10

Sharing

General

Target

Recovery.exe
Size

107KB
MD5

d90957d3cd23fbe36dedf1de6faa40d7
SHA1

d4eaf5265a509389673f78621f2b8fad4469534b
SHA256

d5acc827ecfc0a6944eb3b7fe4e1de10c433f8bacbf9e5ac576a5fbd55219f36
SHA512

aee281bbeace797741126ccdb5b516bfb265b6630f16ffaf44ad840383e42ea11e5fe9b30518c2de652dfc2dfc8521523f99b8e39d79d28691e6049de843c12f
SSDEEP

3072:gL06G8Hl9Sfhw4mzbW/hg0cYpG1RgN1UeeXB:gL48F9S2NbAhg0cYpG1RgN1Ues

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

Recovery.exe

Files

Recovery.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

Recovery.pdb

Imports

mscoree

_CorExeMain

Sections

F5[Vm$
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ