elostrap v4[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
elostrap v4.exe
Size 2.1MB
Sample260717-eng99set5y
SHA256 67c1969d37037609796943a34aee61b5b5ec6f25f3fa13984577ea1d4874b8e9
MD5 f51ce964a9d5e9a54bcc3c67ffdeec35
SHA1 f12cf42df1bbba90bf20e6155395ddcaf56cce66
SHA512 823a78cdf79ededa0fcd8770e98d1da5d74bc195af633b762d9e13d71e7bc9216aa17331e8ba57d0c8fa685541900d9805352fb441958699bbb2f5c51e716818
SSDEEP 24576:i5UYPArBGcMTrEuIy84WnSIpd+2ZBmZaQstbokJMxqavDjWLyvt487diDxeer0a:xmeweJhphCUod1vDiLyh7
TLSH
T185A5AE27A2108EECD0B5C3FC5882D692AA323C44533612CB52E53A56DEB7DC21F7E957
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
elostrap v4.exe

File Explorer

elostrap v4.exe

.exe 2.1MB

elostrap v4.exe

SHA256 67c1969d37037609796943a34aee61b5b5ec6f25f3fa13984577ea1d4874b8e9
MD5 f51ce964a9d5e9a54bcc3c67ffdeec35
SHA1 f12cf42df1bbba90bf20e6155395ddcaf56cce66
SHA512 823a78cdf79ededa0fcd8770e98d1da5d74bc195af633b762d9e13d71e7bc9216aa17331e8ba57d0c8fa685541900d9805352fb441958699bbb2f5c51e716818
SSDEEP 24576:i5UYPArBGcMTrEuIy84WnSIpd+2ZBmZaQstbokJMxqavDjWLyvt487diDxeer0a:xmeweJhphCUod1vDiLyh7
TLSH
T185A5AE27A2108EECD0B5C3FC5882D692AA323C44533612CB52E53A56DEB7DC21F7E957
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

453600

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

463KB

Virtual Size

462KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

120KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

296KB

Virtual Size

296KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.enigma1

Size

536KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.enigma2

Size

740KB

Virtual Size

740KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

elostrap v4.exe

generic