Exm Premium[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Exm Premium.exe
Size 10.7MB
Sample260804-r9pyfsce65
SHA256 590b76fbaa1e2e318ac992d70e5d387145bc714802ea6efe35fcf4160a089ebf
MD5 cac7debea1217a51c3720e9dfa08f1cc
SHA1 63dc63bde19edb5d6aaf668a6f5dedb0139e8f96
SHA512 cc7f1325c5747eb12f89f58ffa2d6a1beab06e812efe770a803192d10ea28589623030d918893344222c65babe3ba5d731fe55b650c453561594e7f2da4847d1
SSDEEP 98304:Vs+06mU+/vUIEGXqAB2qldbU6fRkze3ykimB1PF2EEaO:VkUIEGaABtlN7L3ykim2
TLSH
T1C3B64A47ECA545E8C5AED135CA669252BB707C485B3027DB2B60F3283F76BD0AE79310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Exm Premium.exe

File Explorer

Exm Premium.exe

.exe 10.7MB

Exm Premium.exe

IMPHASH d42595b695fc008ef2c56aabd8efd68e
SHA256 590b76fbaa1e2e318ac992d70e5d387145bc714802ea6efe35fcf4160a089ebf
MD5 cac7debea1217a51c3720e9dfa08f1cc
SHA1 63dc63bde19edb5d6aaf668a6f5dedb0139e8f96
SHA512 cc7f1325c5747eb12f89f58ffa2d6a1beab06e812efe770a803192d10ea28589623030d918893344222c65babe3ba5d731fe55b650c453561594e7f2da4847d1
SSDEEP 98304:Vs+06mU+/vUIEGXqAB2qldbU6fRkze3ykimB1PF2EEaO:VkUIEGaABtlN7L3ykim2
TLSH
T1C3B64A47ECA545E8C5AED135CA669252BB707C485B3027DB2B60F3283F76BD0AE79310
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

511840

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

4.9MB

Virtual Size

4.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5.1MB

Virtual Size

5.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

435KB

Virtual Size

786KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

115KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

103KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Exm Premium.exe

kernel32

generic