diskc[.]sys fake file[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

diskc.sys fake file.exe
Size

9KB
MD5

fe9b80318747c03eb6989fb1bfc80f88
SHA1

ddeea1bb58f64a64eff54972577fd7b669131653
SHA256

41b6cae6c7ca83517046f800a81229d6bc2775a52d3c75918e1b30bc54330700
SHA512

50664514e471a0e33e0b1c09d9a11cdb3897d0caa97a2bf651ca08ed41082b8f10f3de9f5a4b01820fe319abaff254d2ddbda2b0287ed31bccf98472fa0d1f7a
SSDEEP

192:DTF+kR8Ua0DUryJZaXxBE7HA+fEpGqs8QVc7TUo:DR+kR3aPUZq6EMV2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
diskc.sys fake file.exe

Files

diskc.sys fake file.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\C# Projects\diskc.sys fake file\diskc.sys fake file\obj\Debug\diskc.sys fake file.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ