30995b617a141cbd616c0d63f956ad80ecab2b04e5aac498aaae297429f45e63 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

30995b617a141cbd616c0d63f956ad80ecab2b04e5aac498aaae297429f45e63
Size

2.6MB
MD5

83dd3d4c28ca2ea6db1cf49e1a91b670
SHA1

291235aa25e142fc08a079b39aa563d1bbea6163
SHA256

30995b617a141cbd616c0d63f956ad80ecab2b04e5aac498aaae297429f45e63
SHA512

16d81fd83aa7ca05a00db7768e95e91cdce2f0200733dce0506b93411fd67d87afadbab54dcf691c066ed95e104b6a15aa3a301f58f7954458791c3c410355d0
SSDEEP

49152:WRArd9EewWMKZcmp5PA3Dup0G6Xc7p0643W+k4dWKhJ0OfAGKJWEd2GcjlqMgwUZ:WR9JEZcmp5PAEwSp2G+k4cs0KAGYWGD9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
30995b617a141cbd616c0d63f956ad80ecab2b04e5aac498aaae297429f45e63

Files

30995b617a141cbd616c0d63f956ad80ecab2b04e5aac498aaae297429f45e63
.dll windows:5 windows x86 arch:x86

3b5f15cc606684e78a027b7398983028

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

AssignProcessToJobObject
CancelIo
GetBinaryTypeA
GetModuleFileNameA
LoadLibraryExA
GetSystemTimeAsFileTime
LoadLibraryA
LoadLibraryExW
OutputDebugStringA

user32

OemKeyScan
DeleteMenu
IsCharLowerW

version

GetFileVersionInfoSizeA

winmm

midiStreamOut

gdi32

SetROP2
FlattenPath
Chord
SelectClipPath
GetClipRgn

advapi32

InitializeAcl

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ