unknownspf[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

unknownspf.exe
Size

629KB
MD5

ba22d6bc9c22e8425f750640e6bbef4d
SHA1

cc3030e1ceaa06e564bf190dd825157b48b8f8bc
SHA256

4a2587fd9c4ba1bbe2266861a288c5028e178525a43838e88a51e3d8374cc8f3
SHA512

b5a8815d1ce5a9c61e86d1aac47493d2aba5e9762a5450e7968c12de8d9a92ff0af84202bb94734e0dd1feddaee587c044369f9ecc44859c6ef2d63983f8fbbe
SSDEEP

12288:sEKas9BLsG3KhwII5qdo+BDDuGSx4ZRFqrC6/Jcg+lFaYX/y:sERYui0wXF8DKr4ZRFqr5/JlGFaYvy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unknownspf.exe

Files

unknownspf.exe
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: - Virtual size: 537KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.UNKNWNS
Size: - Virtual size: 272KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.UNKNWNS
Size: 624KB - Virtual size: 623KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ