2026-11-06_f5344b2f3913bfd81f0a5045bcc493c3_coinminer_dosia_elex_glassworm_malwareactor_omgwtfbbqapt_minervabot_poet-rat_quasar-rat_rex_sliver_snatch_zxxz
- IMPHASH 745590b29f3877586fd85b67485bf687
- SHA256 5e7ea3d70ff7e700f467a1d937b7d5e489d7fbe9055882956741ef76fa71e0f0
-
Detects Windows executables referencing non-Windows User-Agents
-
Detects command variations typically used by ransomware
-
Detects executables Discord URL observed in first stage droppers
-
Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
647008
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
15.9MB
Virtual Size
15.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12.3MB
Virtual Size
12.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
452KB
Virtual Size
32.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
848KB
Virtual Size
847KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ