Source: AQSEFheXAt.exe |
ReversingLabs: Detection: 15% |
Source: AQSEFheXAt.exe |
Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE |
Source: AQSEFheXAt.exe |
String found in binary or memory: http://github.com/garycourt/uri-js |
Source: AQSEFheXAt.exe |
String found in binary or memory: http://json-schema.org/draft-07/schema |
Source: AQSEFheXAt.exe |
String found in binary or memory: http://json-schema.org/draft-07/schema# |
Source: AQSEFheXAt.exe |
String found in binary or memory: http://json-schema.org/schema |
Source: AQSEFheXAt.exe |
String found in binary or memory: https://aws.amazon.com |
Source: AQSEFheXAt.exe |
String found in binary or memory: https://github.com/aws/jsii |
Source: AQSEFheXAt.exe |
String found in binary or memory: https://github.com/aws/jsii.git |
Source: AQSEFheXAt.exe |
String found in binary or memory: https://github.com/aws/jsii/issues |
Source: AQSEFheXAt.exe |
String found in binary or memory: https://github.com/jprichardson/node-fs-extra/issues/269 |
Source: AQSEFheXAt.exe |
String found in binary or memory: https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/data.json# |
Source: AQSEFheXAt.exe |
Static PE information: Number of sections : 12 > 10 |
Source: AQSEFheXAt.exe |
Static PE information: No import functions for PE file found |
Source: AQSEFheXAt.exe |
Static PE information: Data appended to the last section found |
Source: classification engine |
Classification label: mal56.troj.winEXE@0/0@0/0 |
Source: AQSEFheXAt.exe |
Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
Source: AQSEFheXAt.exe |
ReversingLabs: Detection: 15% |
Source: AQSEFheXAt.exe |
String found in binary or memory: net/addrselect.go |
Source: AQSEFheXAt.exe |
String found in binary or memory: github.com/saferwall/pe@v1.5.4/loadconfig.go |
Source: AQSEFheXAt.exe |
String found in binary or memory: github.com/aws/jsii-runtime-go@v1.101.0/internal/kernel/load.go |
Source: AQSEFheXAt.exe |
String found in binary or memory: MXjsXMnKMN/load.go |
Source: AQSEFheXAt.exe |
Static PE information: Virtual size of .text is bigger than: 0x100000 |
Source: AQSEFheXAt.exe |
Static PE information: Image base 0x140000000 > 0x60000000 |
Source: AQSEFheXAt.exe |
Static file information: File size 11465048 > 1048576 |
Source: AQSEFheXAt.exe |
Static PE information: Raw size of .text is bigger than: 0x100000 < 0x483600 |
Source: AQSEFheXAt.exe |
Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x850c00 |
Source: AQSEFheXAt.exe |
Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE |
Source: AQSEFheXAt.exe |
Static PE information: section name: .xdata |
Source: Yara match |
File source: AQSEFheXAt.exe, type: SAMPLE |
Source: Yara match |
File source: AQSEFheXAt.exe, type: SAMPLE |