malie[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
malie.exe
Size 4.2MB
Sample260821-fsvltstdjb
SHA256 a753b42942bcc0c33a49b04e560452ba413ba18090d466c8494a07221d2baf44
MD5 cb2fc59b0f1e45acddb6b08a3d3347f2
SHA1 3caadb93e6fce221a12edd5d020e83dd32ddbeb5
SHA512 fe604545880b0b1ee46944f1368bf666a0643d4c9c04a192131c20fa757a90d91953f9a7922f4bad8c71b6c86f35c265fa24f4ca726c6ab83bec9754238851dd
SSDEEP 49152:1WHx25OJ3t3RkBnYkDYXZMe+eeCl/hus4a65UVFFP2CPoFD0+idSTcpqjCjSO:gZWBvDYxWClJ4a65UVFV2NMcjCW
TLSH
T16616BF00B6818035E4F201B196FEAB7B55397E382739C4D3D7C42DA96E708D3AA3675B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
malie.exe

File Explorer

malie.exe

.exe 4.2MB

malie.exe

SHA256 a753b42942bcc0c33a49b04e560452ba413ba18090d466c8494a07221d2baf44
MD5 cb2fc59b0f1e45acddb6b08a3d3347f2
SHA1 3caadb93e6fce221a12edd5d020e83dd32ddbeb5
SHA512 fe604545880b0b1ee46944f1368bf666a0643d4c9c04a192131c20fa757a90d91953f9a7922f4bad8c71b6c86f35c265fa24f4ca726c6ab83bec9754238851dd
SSDEEP 49152:1WHx25OJ3t3RkBnYkDYXZMe+eeCl/hus4a65UVFFP2CPoFD0+idSTcpqjCjSO:gZWBvDYxWClJ4a65UVFV2NMcjCW
TLSH
T16616BF00B6818035E4F201B196FEAB7B55397E382739C4D3D7C42DA96E708D3AA3675B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2751489

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.always

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.smile

Size

597KB

Virtual Size

608KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.2019

Size

80KB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

258KB

Virtual Size

260KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

155KB

Virtual Size

9.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

9KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=1, id=199, version=41118,

count=85, id=223, productName=VS2013 build 21005, version=21005,

count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=20, id=228, version=40629,

count=4, id=25, version=9210,

count=1, id=28, version=9178,

count=3, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=12, id=95, version=2067,

count=6, id=18, version=8444,

count=146, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=30, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=264, id=224, productName=VS2013 build 21005, version=21005,

count=97, id=225, productName=VS2013 build 21005, version=21005,

count=90, id=224, version=31010,

count=20, productName=Unmarked objects (old),

count=3, id=221, productName=VS2013 UPD5 build 40629, version=40629,

count=524, id=1, productName=Unmarked objects,

count=182, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=156, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,