36311db92ba16f0f027923ae8e2986d9 | Triage

Sharing

General

Target

36311db92ba16f0f027923ae8e2986d9
Size

484KB
MD5

36311db92ba16f0f027923ae8e2986d9
SHA1

1035038cd6a11fd88bf911cee28dbfc893e15420
SHA256

2db07ea0380b01591b156717d1d672e1fb635b2912ba4a31458cf129b084c2c9
SHA512

7a1e9a6d15376169f3fa8fbac8567e917cd8d11b5d8383b747357a5df5b7ae5d0dcde7b5a4469b07326264375d96c4cb77628d4383d23aaf2b33a2f4feede16b
SSDEEP

6144:il134tl8FukzDmBS+t/qRvtH9ySShKEHYjQiWOeHP/8AMlqCeM4DYnbZj6bADj49:G4t6zV+1MdySvjjIX8AMdbb0cXf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
36311db92ba16f0f027923ae8e2986d9

Files

36311db92ba16f0f027923ae8e2986d9
.exe windows:4 windows x86 arch:x86

46fef1eea68e4fe4e14851d12c62bff8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtCompactKeys

user32

GetClipboardSequenceNumber
DefRawInputProc

kernel32

GetSystemDefaultLangID
GetCommandLineW
LockFile

advapi32

LsaSetInformationTrustedDomain

Sections

.text
Size: 478KB - Virtual size: 480KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 129B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE