keha[.]exe | Triage

Sharing

General

Target

keha.exe
Size

4.7MB
MD5

3d8f68fa535b68ff8a70623649b03c8c
SHA1

cf989e63fc30d4e263f1877643bc1b6717b65a3c
SHA256

c97166af535a566e8f862cd46356b17de3ef1b9895ea2ce21c42dbcd4b968790
SHA512

c6f1263e712dbc806904288e7fbc8a005fe7868a70b2636099b43428e0c12e15214ab65f882fe7273bfcfa74b6debaed433c591ba4709908fad205cda5ee3723
SSDEEP

6144:k0zhu0Tfjb/W2SA0o1WQLGqzLF2A4fxBLWeimUW/4QpRolh2bACPKv+8fSjH5Wnq:xTTe2SmZBZ2xZRWlmXw0RVKml7caRHH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
keha.exe

Files

keha.exe
.exe windows:4 windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 460KB - Virtual size: 459KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ