Static task
static1
Behavioral task
behavioral1
Sample
kenyer.lgn.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
kenyer.lgn.exe
Resource
win10v2004-20231215-en
General
-
Target
kenyer.lgn.exe
-
Size
6.5MB
-
MD5
dc1b7e041e21c351d6103547c6233190
-
SHA1
bb900600d6d9cad1ca0360e8dd6098510abd855f
-
SHA256
38f8e745d8b3a15d1404882c60e1895156ec4a6a57d7e4442e7ecc56343399d7
-
SHA512
bfb8857ba5d7c52f3a3c9d735a3b3a33b36b88ead9592143962668b9d56de0429adc4210ef103c2fd87531808f67661507fd261e855b4de74c1239ee4ca060e5
-
SSDEEP
98304:v9HQi7VtGKJpDb0O70cvAqczxTGrJ9WYkw7ClQ/qZCzfx2zFWjfeFEuDMPQDjT:ai/pDbH7uxSrJ9awuCCZCtDY1DMG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource kenyer.lgn.exe
Files
-
kenyer.lgn.exe.exe windows:6 windows x64 arch:x64
d989a65b132932be865aac05bf9f6644
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
windivert
WinDivertClose
winmm
timeBeginPeriod
kernel32
GetVersionExA
GetVersionExW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
AllocateAndInitializeSid
msvcrt
___lc_codepage_func
shell32
DragAcceptFiles
user32
BeginPaint
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
Arc
ole32
CoInitializeEx
comctl32
ImageList_Add
comdlg32
ChooseFontW
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 817KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 145KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.buildid Size: - Virtual size: 150B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 373KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lgn0 Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.lgn1 Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 117KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ