QueryAutoConvert[.]exe | Triage

Sharing

General

Target

QueryAutoConvert.exe
Size

369KB
MD5

c486c6e3d7311b2e7a56e8fd7c3568f0
SHA1

457cbcb3c0ceaa7a32587414ee0488eecc5f8ce9
SHA256

7bbf1988dd19c7d159d0207f7cf9dbea9c507c7133e668101a9c3807b11320ee
SHA512

e3164412ef89968d575b62c9d46a4ffca708da1ee97fe9f4b1996c14c335638798bea34ce49940806d013edee1a1baf2743c2ef59b1e72817136598b532b9752
SSDEEP

6144:ttM5TuVBnuYS6dRpL07D5IEuTrfuHEyVsDrD5IEuTrkuHEqVsn:tu6S6Lp06I1l

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
QueryAutoConvert.exe

Files

QueryAutoConvert.exe
.exe windows:4 windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 237KB - Virtual size: 237KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ