Security Protection Windows[.]pif | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Security Protection Windows.pif
Size

108.7MB
MD5

16189449259f10a397d3084b7883c2c2
SHA1

921ec235f111c69dc14579d36994c0253824a62b
SHA256

3e0c3ca4857a5612b42b876d473201b4df4a392dd30e03205c84a16ed114f8b3
SHA512

7a090b0e227fa3356dccf11208fa296047e67073dca62916784537d0a720a257ad41dc20e6f902ac405e8ee306db834ec91fccc0c06c0be7106118516bbd7461
SSDEEP

3145728:y2NF2U1ORpI1qReLzpCVeONOBUV9q3ZpvZg/Wb5hy58:xf1uVIpLPUVimWbTy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Security Protection Windows.pif

Files

Security Protection Windows.pif
.exe windows x64

2b7024ff8250e4f2afd5d65dd8213178

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetModuleHandleA

shell32

SHGetIconOverlayIndexA

advapi32

GetUserNameW

user32

GetDC

Sections

Size: - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 105.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: - Virtual size: 140KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE

Size: - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 776B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE