client[.]exe | Triage™

General

Target
client.exe
Size 273KB
Sample261028-nhzrsscv2m
SHA256 3816e027078f67b2744d8da307097f535bb3718d70de94440e940f936301321f
MD5 74230dce9f13448ac20e6b97188c22de
SHA1 2e8ef45f956afa9d30bec2ca21ffc88b9f97afd0
SHA512 0bc9ac978f1b46aca0b499727d255c8858555e8454af75c960a369505f43491620569b14a0eb6f75e53bc50057d91df1800b25685c06f1c6d90fc8bd35650168
SSDEEP 6144:V1VUU2W22SNeXzgNczvAh0KQDDSiyg/Z2lq3F6dFCllu8EUHPTjkj9:VQB0SNuzgNcN9SiUlq3Pu6rjk9
TLSH
T1BA5412C38DBE239AD591267A197D543A007E720C7D10E4BA3DD093CAAEC354A798F3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
client.exe

File Explorer

client.exe

.exe 273KB

client.exe

SHA256 3816e027078f67b2744d8da307097f535bb3718d70de94440e940f936301321f
MD5 74230dce9f13448ac20e6b97188c22de
SHA1 2e8ef45f956afa9d30bec2ca21ffc88b9f97afd0
SHA512 0bc9ac978f1b46aca0b499727d255c8858555e8454af75c960a369505f43491620569b14a0eb6f75e53bc50057d91df1800b25685c06f1c6d90fc8bd35650168
SSDEEP 6144:V1VUU2W22SNeXzgNczvAh0KQDDSiyg/Z2lq3F6dFCllu8EUHPTjkj9:VQB0SNuzgNcN9SiUlq3Pu6rjk9
TLSH
T1BA5412C38DBE239AD591267A197D543A007E720C7D10E4BA3DD093CAAEC354A798F3A5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator\Desktop\RootSt-Stealer\PrismLoader\obj\Release\net48\OfficeFence.pdb

Sharing

General

Malware Config

Signatures

File Explorer

client.exe

generic