R3nz_Loader[.]exe | Triage

Sharing

General

Target

R3nz_Loader.exe
Size

689KB
MD5

b43d8eca7777b170ddc40a824ab10bb6
SHA1

a7da0bbde621a7df3489b394ee4e5cea963225e6
SHA256

1db1a4c253278293c863dff9759c6577f1b6b5b8f69ac0c612338453eeea96d9
SHA512

54c6ec0681b7e67782c4d142450f84bef5129c4cfa4dfbd70edc63bd3385d8cc9277cdfbcf2c3a8f6c5cb49b9252eb8c46984a65164164886b805e084e6bbb55
SSDEEP

12288:ENvwXTkEVI9HBoDWupxGsFITxLmIJpCbp4/MLq/xgtQS7iBDgCL+ZNNzloh3LouP:ENoXQEV2hozxG0c0bp2Y4oQSW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
R3nz_Loader.exe

Files

R3nz_Loader.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

^]tBD;I
Size: 554KB - Virtual size: 554KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 131KB - Virtual size: 130KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ