C:\Users\keshs\Downloads\krnl_bootstrapper\krnl bootstrapper\obj\Release\krnl_bootstrapper.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ks4.021.3.10.391en_25092.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ks4.021.3.10.391en_25092.exe
Resource
win10v2004-20240802-en
General
-
Target
ks4.021.3.10.391en_25092.exe
-
Size
1.1MB
-
MD5
88a6615157fafbefea10e5207d54e292
-
SHA1
bc695c8b579e989cdcec11d5252aac5a3296cc23
-
SHA256
426a066a7c5ed3e91f9ab5aadb860e969fbf74689179e02fa3b3d5e5e36cbd6e
-
SHA512
8546938f656bf4c799071a3efaf8e49aaad0ddb899d1a524b66021b92e6cd71c186b7f6ba0b16ab36963b11223027083168be5496612ad2ef09dc4f1d0319118
-
SSDEEP
12288:/+BVCrK2jsP3zv+FSF68GANNhWLS0B6L+FOCN+AzrnxdanvzFzh:/uU7ecSgL6y+gk+rnxdarF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ks4.021.3.10.391en_25092.exe
Files
-
ks4.021.3.10.391en_25092.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 916KB - Virtual size: 916KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 250KB - Virtual size: 250KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ