GDMO[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
GDMO.exe
Size 11.7MB
Sample261006-ysh7xat19n
SHA256 edd2e7da3828b2863d7fca18c0ab66576238e3beb4a2803929a5acd5465ccb96
MD5 8503465468b0cbfedb1c4f4b74d1ee29
SHA1 cc9949245a041b4dc85bb134d4f2f04981cac704
SHA512 9d79869552f33fd13ee354ec96122ef16290428e45467f99035bc9ea2fd8d062cb9ca6d2da630966eab9fd65aae6f001e0636ada8692380e87e3dda6f345f9a8
SSDEEP 196608:rzVkcJjWrMrD8SYZAnxDdLCneu54OEPU7/4c1+5jaFT1DGsbkphaK:nJprDnYSnPXuiOEP21nFTpGsbkpR
TLSH
T140C63372A1816FD7E19193775C2BC449EC0AE6B09F022774E56FAFA4E21604DCBF4B24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
GDMO.exe

File Explorer

GDMO.exe

.exe 11.7MB

GDMO.exe

SHA256 edd2e7da3828b2863d7fca18c0ab66576238e3beb4a2803929a5acd5465ccb96
MD5 8503465468b0cbfedb1c4f4b74d1ee29
SHA1 cc9949245a041b4dc85bb134d4f2f04981cac704
SHA512 9d79869552f33fd13ee354ec96122ef16290428e45467f99035bc9ea2fd8d062cb9ca6d2da630966eab9fd65aae6f001e0636ada8692380e87e3dda6f345f9a8
SSDEEP 196608:rzVkcJjWrMrD8SYZAnxDdLCneu54OEPU7/4c1+5jaFT1DGsbkphaK:nJprDnYSnPXuiOEP21nFTpGsbkpR
TLSH
T140C63372A1816FD7E19193775C2BC449EC0AE6B09F022774E56FAFA4E21604DCBF4B24
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

31178752

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\DMW_BUILD\GDMO.pdb

Name

Size

2.9MB

Virtual Size

7.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

398KB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

21KB

Virtual Size

209KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

13KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

226KB

Virtual Size

413KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.debug

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.imports

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

12.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

8.2MB

Virtual Size

8.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Name

.taggant

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

generic

count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=156, productName=VS2010 build 30319, version=30319,

count=2, id=171, productName=VS2010 build 30319, version=30319,

count=3, id=199, version=41118,

count=12, id=259, version=24723,

count=13, id=260, version=24723,

count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=2, id=156, version=21202,

count=4, id=257, version=24723,

count=38, id=261, version=24723,

count=7, id=262, version=23917,

count=5, id=260, version=27034,

count=632, id=261, version=27045,

count=5, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=11, id=261, version=27048,

count=2, id=257, version=28900,

count=19, id=261, version=27050,

count=8, id=265, version=25027,

count=21, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=24, id=260, version=27045,

count=33, id=257, version=23917,

count=4, id=123, productName=VS2005 build 50727, version=50727,

count=750, id=1, productName=Unmarked objects,

count=805, id=261, version=25027,

count=1, id=255, version=25027,

count=1, id=151,

count=1, id=258, version=25027,