SPECIFICATIONS[.]IMG | Triage

Sharing

Copy URL Twitter E-mail

General

Target

SPECIFICATIONS.IMG
Size

1.2MB
MD5

8009db1a4ad177f6458f5493b4723c8d
SHA1

fee554e8d2a055928ad321c82be1cafde2dacf6a
SHA256

470de980ea57e5cbaaf82ffd66229a9c59fbc1ab43b41fa4ba092adcbc305dba
SHA512

4c598ba3320060e423ba698953aff13881bb5bcbb73cc83884e68429aceec85627bab79716c2bfd1c5fa38e7795c016b7e73dacd7e61b951725b95d379a65184
SSDEEP

12288:dr3Qp5I9xWZvHgYAXGWKkv5oT4sIrT9t4G:djOySRA2nsRN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/SPECIFICATION.exe

Files

SPECIFICATIONS.IMG
.iso
out.iso
.iso
SPECIFICATION.exe
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Windows\Containers\Confidential\DotnetGenerator\Stub\Projects\Fallkyriya\obj\Release\Fallkyriya.pdb

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ