Kawaii[.]exe | Triage

Sharing

General

Target

Kawaii.exe
Size

2.6MB
MD5

80abe77c2c53371b5a39f2ded335c8c8
SHA1

484e65248fe796cd9e66c04d087ec4d0217a83cc
SHA256

e6f414475c95a5dc5b98c66b14b600c2be9cc796623b58897d3e3e9ac61749aa
SHA512

a0bec295af51bfd54b0ae4fda7f830bbb28d817c9900fbef598898944d754ff74ec50e2cffde56b6c26549cc906826776711f899dd015d8fbe9015c188c5bfa7
SSDEEP

49152:eZV9xBtVxACg6LTA55Xfmj+sUR1sDVZZHBkbnnTJmyKeG8nQauaBT85smxo9:I9fPfkXfmjW4Dgn0c8Wmxo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Kawaii.exe

Files

Kawaii.exe
.exe windows:4 windows x86 arch:x86

Password: kawaiiiniciar

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

Kawaii.pdb

Imports

mscoree

_CorExeMain

Sections

m+BC-^
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 217KB - Virtual size: 216KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ