ntoskrnl2[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ntoskrnl2.exe
Size

1.4MB
MD5

c8848d70c25cf0a1e0a4122cab55e5f8
SHA1

20e0cffe94951e3201ca5aa3f5a2876b20408702
SHA256

6ebed9f6de82360a3724c5148eaaced3273ce3e48826492d87da9d7e978eb6fc
SHA512

b93aada5cdf824c5feb5c2a992a92cb929479241e7895c42c8a6af32b11c72767523d4abd641c44a0b2e310288e533f7aeef3f1931023ac72154171bc83d2cc0
SSDEEP

24576:qQnFtu+zlSu7WlmZuTJ8BNTnCe2RmndNY2ncoC8OOGOFqZjkJe6QvX:Hpz7BNBNTnx2azxcoBrZS3fP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ntoskrnl2.exe

Files

ntoskrnl2.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 800B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ