kensingtonworks[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

kensingtonworks.exe
Size

963KB
MD5

77287b8ceb4de0ebc5152030f744a576
SHA1

53522811894c326943204c24ee67f1a32dac52f4
SHA256

d071181058b9588180af370a2d7c3e9a69dd9d8aeb9f6c301f33bf8c3fda5c10
SHA512

cb054ab60f9893fe18ee70e59174da6789d5d407804fb1e7ad20e456eabf9c6fb846199e0cc9ea22dd83c16d3179370c483b824b4bec4a6780622af665abc629
SSDEEP

6144:Xw7h/ZiJB6NEy1cpY65Rem+BCBQH1E1VOPlx9RUXMGIxyS8ODWC+NvnjPPPIDqP1:Xs/wJBdpE/48P7bKJIx+ZpNvjPPw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
kensingtonworks.exe

Files

kensingtonworks.exe
.exe windows:4 windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 945KB - Virtual size: 944KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ