exec[.]zip | Triage

Sharing

General

Target

exec.zip
Size

277KB
MD5

9cbd27a940c2fdf9dec2d3306b11a33b
SHA1

b642558de5651a0220c7da4c5ec1eb7cb921f30b
SHA256

f6c61a28768f237dde26fcdfca3c1224f931d054cbca30fff692561ae702da6d
SHA512

93a8f1845c9abce5d68d993774114e5ebd6d73c6c72528a0f7c89dafa53617bdb8eecb939153ed9fd8d644e3ae2aa1a66c4725baec2843ffb2ed3a12c0eae4cb
SSDEEP

6144:dn4KmLPVT4YYdrja2mXF68JtitgGqvUqtAdBCZpDV0em15a:dnDIVTgja2mXF1itgGqvjmoZpDhm1Y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Bootstrapper.exe

Files

exec.zip
.zip

Password: 290769
Bootstrapper.exe
.exe windows:4 windows x64 arch:x64

Password: 290769

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 797KB - Virtual size: 797KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
DISCORD
workspace/IY_FE.iy
workspace/fontface.font
workspace/homohack/pf-lite/settings/awd.json
workspace/smallest_pixel.ttf