Dekont_30[.]bz | Triage

Sharing

General

Target

Dekont_30.bz
Size

553KB
MD5

724ab22aca92e7ca5bc50d561f2e7eab
SHA1

7fd5f33625478c04745a96733f0bb8e896ae0267
SHA256

4f4856cb0d348857a9c1080460bad16f6d5ab86c51b8041734a9c3204c5fc57c
SHA512

b8e5738d81dc010d36d19154a2be7900d3081549c193db521147125547b0e99c9cd3b001718cf925e65e0adf748342a518dd8d121789d783ec787dcd886f6198
SSDEEP

12288:TKZvH8J8WVbn+IDQ5Uy3e8V2ckPJBItf29WH6CaOaFmUx:TOvcnVbn+wQGy30cqs2Ca/FmK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Dekont_30.exe

Files

Dekont_30.bz
.rar
Dekont_30.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

HSkm.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 801KB - Virtual size: 801KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ