30e540c2084029d321817d26f52e8afb | Triage

Sharing

Copy URL Twitter E-mail

General

Target

30e540c2084029d321817d26f52e8afb
Size

327KB
MD5

30e540c2084029d321817d26f52e8afb
SHA1

118231b1497bbea8862242b29fafe857a2ecb296
SHA256

6d533d43ecdd4ed86b1f5877f27e95910c8ea91c9118063e5c5c49b48268eda2
SHA512

85d4e617785e57e7f815a8980e1c67563b3ec027f54f846365306718d8e01690316b0bcf8255eb9d3b6bb00a84a8315b1ec4d1b451c37b27bda214fa15beb9b0
SSDEEP

6144:pQinbaiHA6Cme0nHDGgtZr0tfHdMdAUwUmPcC8zzpasv5T4I0copJHpi:1An/U1tkHc1wUmPkzt58I7U3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
30e540c2084029d321817d26f52e8afb

Files

30e540c2084029d321817d26f52e8afb
.exe windows:4 windows x86 arch:x86

3ee492c0e07052805ef5806c51825e61

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetLastError
IsBadReadPtr
GetCommandLineA
FreeConsole
DeleteCriticalSection
IsBadCodePtr
EnumResourceTypesA
GetDateFormatA
FindClose
GetDiskFreeSpaceExA
GetLastError
LoadLibraryExW
TlsGetValue
CloseHandle
LocalFree
VirtualProtect
Sleep
GetDriveTypeW
GetModuleHandleA
PulseEvent

advapi32

LsaFreeMemory
FreeSid
RegCreateKeyExA
OpenEventLogA
CloseEventLog
RegLoadKeyA
CloseTrace
LsaClose
AccessCheck
LsaSetSecret
GetFileSecurityA
IsValidSid
RegCloseKey
RegCloseKey

uxtheme

CloseThemeData
DrawThemeIcon
GetThemeColor
DrawThemeText
GetThemeBool

Sections

.text
Size: 3KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 522B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ