malware_p[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
malware_p.exe
Size 44KB
Sample260906-1vnaratcph
SHA256 5c10ac1c6a40c75076794e5560a05083eb7f5a8c6ff507cb18de4fbe241dd86a
MD5 febccb7f211d450dfa86c31f4b6328a8
SHA1 d823e3df27cd0cb339e23bc257a697a2bff9624f
SHA512 32f28180964b713a4041b851d10912243060826f0e3c12c9f2e85ec23f2da528dee6f805143a4913de7d254fcbe60a5ece69e6ffa2ab83a964df0032bb73afce
SSDEEP 768:LVsR5WQLlsga+NpPvFrmSHGgHwezlMz8+guyIMOcptloQj0/1BBBBBBBBBBBBBBk:ZsRxlyOlmSHhHwO8nStf//V
TLSH
T181235B5A23A355F8D60AC97481F30FB0A971FC3204718D7F23A5FD362E25D526F1AA29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
malware_p.exe

File Explorer

malware_p.exe

.exe 44KB

malware_p.exe

IMPHASH e19d82a9f9b31ef7aa9bf99ea5401ff0
SHA256 5c10ac1c6a40c75076794e5560a05083eb7f5a8c6ff507cb18de4fbe241dd86a
MD5 febccb7f211d450dfa86c31f4b6328a8
SHA1 d823e3df27cd0cb339e23bc257a697a2bff9624f
SHA512 32f28180964b713a4041b851d10912243060826f0e3c12c9f2e85ec23f2da528dee6f805143a4913de7d254fcbe60a5ece69e6ffa2ab83a964df0032bb73afce
SSDEEP 768:LVsR5WQLlsga+NpPvFrmSHGgHwezlMz8+guyIMOcptloQj0/1BBBBBBBBBBBBBBk:ZsRxlyOlmSHhHwO8nStf//V
TLSH
T181235B5A23A355F8D60AC97481F30FB0A971FC3204718D7F23A5FD362E25D526F1AA29
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

D:\Projects\build_v1\Release\core.pdb

Name

.text

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

192B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

808B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

132B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.pdbg

Size

512B

Virtual Size

90B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

malware_p.exe

kernel32

msvcrt

generic