Exodus[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Exodus.exe
Size 15.0MB
Sample260802-y6a4fsfc53
SHA256 e41a9dbb86dba2009578a2ca18eb7257db729626afe4c0a33eaaf02be3c08626
MD5 77dac46872962d5f56436db11d727737
SHA1 27f75a11e1203a3a55fe22e6509e0baecc53c442
SHA512 dfede9a7c5407251bb604d2bde9c05b2dedd4c23e366b4aebde88895fa375d1be0b8ee0cf1654d390558d6f6a77a03024dd8b7b5c8510335309453a733a7f923
SSDEEP 393216:oK+UPNchgt4u9Mo01TZhfzOk4JdhyBQzaax:o+3tB9M51TZhpUIf
TLSH
T17FF63325FCE46530F0DCABBD2A4E82A7F8647213011BC31F6DA3617B38AAD45356A17D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Exodus.exe

File Explorer

Exodus.exe

.exe 15.0MB

Exodus.exe

IMPHASH e81d90b230abc81b286482b9dba12e35
SHA256 e41a9dbb86dba2009578a2ca18eb7257db729626afe4c0a33eaaf02be3c08626
MD5 77dac46872962d5f56436db11d727737
SHA1 27f75a11e1203a3a55fe22e6509e0baecc53c442
SHA512 dfede9a7c5407251bb604d2bde9c05b2dedd4c23e366b4aebde88895fa375d1be0b8ee0cf1654d390558d6f6a77a03024dd8b7b5c8510335309453a733a7f923
SSDEEP 393216:oK+UPNchgt4u9Mo01TZhfzOk4JdhyBQzaax:o+3tB9M51TZhpUIf
TLSH
T17FF63325FCE46530F0DCABBD2A4E82A7F8647213011BC31F6DA3617B38AAD45356A17D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

15.0MB

Virtual Size

15.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

240B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.CRT

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

55KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Exodus.exe

ntdll

kernel32

generic