Kelvi[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Kelvi.exe
Size

14.3MB
MD5

69f38ab1e1306437c4d41d0d5e25c5b7
SHA1

21a6ba5780d842868d4f9bdb4f21578fe692f975
SHA256

86c5b37ec59029354502d5ed0046b6a700acbc8f748ca48e168d3bfb57c9000a
SHA512

6bdcd1291bcd186a17aab539998ff363cadfcc062fb97892571ca15c81abebac2d88471469a074af0d35a9e6afab66ba12dc8391162195743acdfbb0227db190
SSDEEP

196608:dSDioZhE9TMqLJ5PCgiJ/k3GmcMs+pFZYLPAeb55L23ag/3isJfpDtVRLwm+Mdny:dEZh72JMNJkT15ZhkE3ag/nJfddh2RP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Kelvi.exe

Files

Kelvi.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 14.2MB - Virtual size: 14.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ