Koh[.]exe | Triage

Sharing

General

Target

Koh.exe
Size

33KB
MD5

86cccf5aa4bb5b24878eef9747841b82
SHA1

a7f442c642d4443aefe444a526e59ca6921d42e4
SHA256

4ffb4fbd4ca5603361a794c99b365c403b8d59af5788e95a981a7f4ca0bbccce
SHA512

d621c49313a1ecce614afc254bb0ab1d8d627b2f8b339b6ecc15c1445f59b3ff28dc838e770ee6046757b12b41aaf3a114e13777b53ce5234595e7335ab4ec47
SSDEEP

384:N5sWcTNEQyFnp+tOU/KoqH0LoIPebA5XeRL/9qhSxSwR94vZs+IBVX3LYicbVv4Q:f4HHtOUi+3WiQ7X1M8Z3LAv4Q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Koh.exe

Files

Koh.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ