G_X_D[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
G_X_D.exe
Size 9.9MB
Sample260804-dsk2aafl2y
SHA256 2613f50fd96dd728326821e4fb68d2de4f338d5b34b8f0b27a9e2fb10940fd3b
MD5 8720346399501376842d1766861fd1d7
SHA1 7ae2bdd24be3cb6451d06ee2d0e3f8c2afe40043
SHA512 d478fd6733f65d9b7abb93a2dfd695482f9f1f9c6ff0897ade3679e35ab01a2bfcb0240517707264e199391afedd0d66a5618ac9100665f64407ba985e2ecac9
SSDEEP 196608:YssNKbSEeFV4M3+1tWdhvYrigI/GujzmNhtwCUfdYlOeLdRlOyMsiluhx:YssopTuMWYrigI/UlbL5Oyrcu
TLSH
T1B2A633AE2DDF02D5DEC118B0A32B77E732F766D449D34C3669C9244835A2EE2B03AD51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
G_X_D.exe

File Explorer

G_X_D.exe

.exe 9.9MB

G_X_D.exe

IMPHASH 33520bfab54e6ee43249e1890368d674
SHA256 2613f50fd96dd728326821e4fb68d2de4f338d5b34b8f0b27a9e2fb10940fd3b
MD5 8720346399501376842d1766861fd1d7
SHA1 7ae2bdd24be3cb6451d06ee2d0e3f8c2afe40043
SHA512 d478fd6733f65d9b7abb93a2dfd695482f9f1f9c6ff0897ade3679e35ab01a2bfcb0240517707264e199391afedd0d66a5618ac9100665f64407ba985e2ecac9
SSDEEP 196608:YssNKbSEeFV4M3+1tWdhvYrigI/GujzmNhtwCUfdYlOeLdRlOyMsiluhx:YssopTuMWYrigI/UlbL5Oyrcu
TLSH
T1B2A633AE2DDF02D5DEC118B0A32B77E732F766D449D34C3669C9244835A2EE2B03AD51
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11717338

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

Virtual Size

228KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.?rY

Size

Virtual Size

5.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.*Xy

Size

512B

Virtual Size

68B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.cG*

Size

9.9MB

Virtual Size

9.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

G_X_D.exe

kernel32

user32

advapi32

ws2_32

ntdll

generic