krnlss[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

krnlss.exe
Size

1.2MB
MD5

3b26e9f4768e695a004f9b3d41a1bb18
SHA1

5b211bf500981a827b3c94b597b8e709b807ab00
SHA256

45cf955a5c297aead5beb7aeb826f2ff7ec75e54a06d30969e191318dc1210a1
SHA512

05cd6f634a698d7896cd4283d708fba7222a52955563598406cddab99a23ff924b7ea8edc70a5485ba65fbdacd417cd316ac33596d6db918454716e92cfdd9fc
SSDEEP

12288:9blGHm7+G70EE/0GGGGGGhGGGGxdoM43nwVkokbEk:9JGHmC4ysGGGGGGhGGGGx1VpsE

Score

1^/10

Malware Config

Signatures

Files

krnlss.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1016KB - Virtual size: 1015KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 185KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ