f1dskrb[.]rar | Triage

Sharing

General

Target

f1dskrb.rar
Size

1.3MB
MD5

318d354cbeac262807e1593bb2fdc8d9
SHA1

f31ce598370340326f3ec696b70b4d1b4aa655dc
SHA256

fa3cd09143447476f859ef7fea9568df26631d7c6173648f45c4fb74af76dfdd
SHA512

1add873126cc92fec7e88556b1cb039f17d73868e329ff1cde70c4fca18ca8f6050d7757961202dd634b38815a5a41354407e0c6fc28b3e4c1e59258ef2a393c
SSDEEP

24576:/h/ZUh9fNWxuYlOWVcmic3CPco1jRSMlJSLnCff9FoVtXOjDXbFFgFK6oH6FqF:kvWxVlhyiCko1FlJOCAVtMXbFK5Js

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/f1dskrb.exe

Files

f1dskrb.rar
.rar

Password: 123
f1dskrb.exe
.exe windows:4 windows x86 arch:x86

Password: 123

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 615KB - Virtual size: 614KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 16B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 57B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ