zkxxx[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

zkxxx.exe
Size

299KB
MD5

27e49b3d2167ac49262984405c42f6cd
SHA1

0d856e838ae5db5e8b6ff0575ae4b6b39728a274
SHA256

ff35f1355a2a4d4229601fb39bbd5ed42634fbed18238da6a4dee90ec4f13bbe
SHA512

f591325738e587e17a26883e399c1f4494cbab97983288419bc7009b8b0aae47a279894adf78c9f5a9c237fe2f6ec7d98b669b27fb510aa30ca464d603c03329
SSDEEP

6144:IrtrDdIZG2nqJElpL3im9+3Kz9BngKbtPLLd5MJCuzacC45:Id6TnSEl1yt6zzng0LAGcR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
zkxxx.exe

Files

zkxxx.exe
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 272KB - Virtual size: 272KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ