5599b3c6b633d903c29de06459acba19fc1cf0615038c01771b0b5f1c4e5cb8b.exe

BENIGN

Mal-ecule

Size 186.0 KB download

First seen 108 days ago

Analyzed 90 days ago

Objectives

anti-static/obfuscation/binary-metrics Binary has normal code entropy (>5.5)

anti-static/obfuscation/payload PE version resource text

command-and-control/infrastructure Binary has 4 or fewer sections

evasion/indicator-removal Regex component marker

evasion/masquerade/file Filename has EXE extension

evasion/masquerade/identity Two dotted-quad version strings

evasion/process/injection Regex component marker

communications/http/client WebClient.DownloadString method

communications/http/server Access to Headers getter

build Manifest is MyApplication template name

encoded-payload Encoded payload detected: xor

binary .NET Metadata Root (BSJB)

binary/metrics Binary has 1000 or more strings

binary/section PE .reloc section presence

dotnet .NET assembly detected via BSJB CLR metadata signature

dylib::mscoree links mscoree (CorExeMain)

hardening NO_SEH (SafeSEH not used)

lang/compiler mscorlib reference

package PE CompanyName metadata field

binary/anomaly PE version info numeric fields present

20 of 33 traits shown

SHA-256	5599b3c6b633d903c29de06459acba19fc1cf0615038c01771b0b5f1c4e5cb8b
Filename	5599b3c6b633d903c29de06459acba19fc1cf0615038c01771b0b5f1c4e5cb8b.exe

Source	harvest

Not seeing what you expected? Let us know