_SYSTE~1[.]EFI | Triage

Sharing

Copy URL Twitter E-mail

General

Target

_SYSTE~1.EFI
Size

90KB
MD5

26ea5059d13a8c5d2af61d29a4199519
SHA1

2f67aae8c023dc9541a36a54a1677ce14ce5a31c
SHA256

c7aedc5f97bcb4bf316d2645aaf9871f8c67de663cd777c61324a9ef2d5a7738
SHA512

f83e695d7c2ecc34c85e8dbde536ba72c28a93a78757387e2ac8f325e902351553a5eadb59621f01ec94d17b52a02cb16bd962c5a412f6156edb7840447480ce
SSDEEP

1536:Xyp6FZqznDZ8P6CwFM5jSyQ7gxkZXCGpM+akzl5PylcQ1K:XysFZGZm5myWgxASGppajc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
_SYSTE~1.EFI

Files

_SYSTE~1.EFI
.exe windows:0 windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.text
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 809B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sdmagic
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.osrel
Size: 512B - Virtual size: 73B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.sbat
Size: 512B - Virtual size: 234B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ