306997036a42327bbabceaaa7b15b04d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

306997036a42327bbabceaaa7b15b04d
Size

158KB
MD5

306997036a42327bbabceaaa7b15b04d
SHA1

8687b45aa75394196c2dc446391799b8c3bc43e5
SHA256

a4d918cfb05d40d112be74393b259d69deaf1fc4841465892292dbea7d26f1d0
SHA512

30c1bec91eec29f27234603d521d5d3ff78df236e5db3e1341905acaefd6596d90b7b6ddd834ac4bf4fe93e5d8d8353d7d5e2d9585654525f0f97cf902811ab7
SSDEEP

3072:MR/8rqUUfxIdq1n2Uu9r2zJxJDwHTkjRzJFkPnHcCzbKtZc:MB85UfxIcBvwHAjRlFkPnHc2utZc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
306997036a42327bbabceaaa7b15b04d

Files

306997036a42327bbabceaaa7b15b04d
.exe windows:4 windows x86 arch:x86

eb5182d3bdb01e76bf6fed9ecaf6c6e5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CoCreateGuid
StringFromCLSID
CoTaskMemAlloc
CLSIDFromString
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CoCreateInstance
CoInitializeSecurity
CoSetProxyBlanket
CoInitializeEx
CoUninitialize
CoTaskMemFree
CoGetClassObject

rpcrt4

RpcStringBindingComposeW
RpcStringFreeW
RpcSmDestroyClientContext
RpcBindingFromStringBindingW

shell32

SHGetFolderPathW
DragQueryFileW
DragFinish
CommandLineToArgvW
SHFileOperationW

comdlg32

GetFileTitleA

kernel32

GetLogicalDriveStringsA
GetSystemTimeAsFileTime
GetProcessHeap
CreateConsoleScreenBuffer
GetModuleHandleW
CreateProcessA
GetTempFileNameA
HeapFree
HeapAlloc
LoadLibraryW
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoA
TerminateProcess
GetCurrentProcess

oleaut32

LHashValOfNameSys
GetRecordInfoFromTypeInfo
VarUI4FromDec
SysFreeString

Sections

.text
Size: 101KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 316B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ