f0351064Mimikatz[.]exe | Triage

Sharing

General

Target

f0351064Mimikatz.exe
Size

714KB
MD5

27d65a0823ec7a3dd9256dd54ba108ae
SHA1

aa21c556d58e3b982dd355282350939d244538a1
SHA256

c9e176de9bd65e3950df26e9e62c1ae3dcecba26e3bf40c01ddb7542e7e105f4
SHA512

bbcda029e620edcfd48eccb2adb5e5f3ad1456e17a0229624da62bacc5b21742782df9de5205a328d3054904e7878206226c692800f5a716a9f976f8561c37d0
SSDEEP

6144:r/2qk+t4Sfkf+6Onki54nqSGK99xjKcqoxLuhPF+3lSBXmVL/H4CPhVwCCM:r/2yt4SNnf4nqSxHx9qoBuLHC/HxhnCM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f0351064Mimikatz.exe

Files

f0351064Mimikatz.exe
.exe windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 363KB - Virtual size: 362KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 116KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 186KB - Virtual size: 185KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ