KPScript-2[.]57[.]zip | Triage

Sharing

General

Target

KPScript-2.57.zip
Size

24KB
MD5

68d55f4d7cb3b9db928e864ebd7a58a3
SHA1

84063659179bd3f9aeb3f4e87b0922df97d4ee43
SHA256

4440436f768fb51cfc0fd9be8c1c24776219c4c8fab852b61319a45de7e87a74
SHA512

90c45be50e4420aead97eeea151e077b36d7e23e509eff99849c548cf8ddd6e789305dbdcd91bf3a21be95b04ec8f973e075aaa9fe970a53db875212aba6d1d1
SSDEEP

768:wRmXGrC739VnawDoq+LeDLkuf4kvm5aLRU:wagc3HnLDorLez4k+5iU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/KPScript.exe

Files

KPScript-2.57.zip
.zip
KPScript.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Dev_A\KeePassNET\Plugins\KPScript\obj\Release\KPScript.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
KPScript.exe.config
.xml