grpcurl_1[.]9[.]1_windows_x86_64[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
grpcurl_1.9.1_windows_x86_64.zip
Size 7.7MB
Sample260806-ppldesbm6x
SHA256 898bcded6677e296d057207b9246a29f92f5dcb0f46f10711771a5b27e0cf8c1
MD5 ec80a3e391ebc47aea0b2fb3fd6c5b2e
SHA1 b6a0dd1fccd2041096b2e58caefa6648a0281c52
SHA512 2a7806c75b83237bdd1833ff5a5ca9cd03996fea69b9ee4dcd0927061069501e3681e624d6c0ad5531e2c7d343afca926f6e0b306dd72d3c8901ebb31c002714
SSDEEP 196608:tPfe9yVCP7VKlJuqATMtfgIIyjsYCPVFSYhxjtoA6fcm7XjwoYHx:Be8AT/UtfDvgZAYuA6p7X8/x
TLSH
T1AB8633E3CBA4FFA96725C13C4A654C85D10B9471B0A9CC8AF08E98170BF7AF15E6D1D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/grpcurl.exe

File Explorer

grpcurl_1.9.1_windows_x86_64.zip

.zip 7.7MB
LICENSE

1KB
grpcurl.exe

.exe 23.9MB

grpcurl_1.9.1_windows_x86_64.zip

SHA256 898bcded6677e296d057207b9246a29f92f5dcb0f46f10711771a5b27e0cf8c1
MD5 ec80a3e391ebc47aea0b2fb3fd6c5b2e
SHA1 b6a0dd1fccd2041096b2e58caefa6648a0281c52
SHA512 2a7806c75b83237bdd1833ff5a5ca9cd03996fea69b9ee4dcd0927061069501e3681e624d6c0ad5531e2c7d343afca926f6e0b306dd72d3c8901ebb31c002714
SSDEEP 196608:tPfe9yVCP7VKlJuqATMtfgIIyjsYCPVFSYhxjtoA6fcm7XjwoYHx:Be8AT/UtfDvgZAYuA6p7X8/x
TLSH
T1AB8633E3CBA4FFA96725C13C4A654C85D10B9471B0A9CC8AF08E98170BF7AF15E6D1D8
MD5 SHA1 SHA512 SSDEEP TLSH

grpcurl.exe

IMPHASH 4f2f006e2ecf7172ad368f8289dc96c1
SHA256 d664a97a4c730f72f7b0d79d9f6a98433ef0c41510674da48c399cec3a76251d
MD5 864681c29b610c270bd084572fc155b4
SHA1 fcac34ac4b4e497d2a28e1040c41eb4ca1837123
SHA512 976a8bb66618f5b989c34d1e10d4d7706240afd1e234c7dbcd10a1bdaf7e6aaaa654f061a2b0c42fbbfd23f62aae0b8494500de28d302cd13d9a72c69a76e2fb
SSDEEP 98304:1Fkn6adyS0Pzukra2bntWYqnRSwLOr9D7eeclCjglLERcUDVhTyLPuWmwd:bkazR22bntWYM/Orc+fR0LPuWmwd
TLSH
T193472C93F89041E4C4ADD575C56281627F71BC598B3127CF3F60B6286EB2BE0A6BE344
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

443840

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

10.0MB

Virtual Size

10.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

12.7MB

Virtual Size

12.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

748KB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

306KB

Virtual Size

306KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

168B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

227KB

Virtual Size

226KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

grpcurl_1.9.1_windows_x86_64.zip

LICENSE

grpcurl.exe

kernel32

generic