6302f08805736a80b939c7b4e226bc7c0201c8ea567f0aaa5ac058c87c6c829f[.]exe | Triage

Sharing

General

Target

6302f08805736a80b939c7b4e226bc7c0201c8ea567f0aaa5ac058c87c6c829f.exe
Size

671KB
MD5

0d39f2d793cf4c44d27d10dd53bf8b25
SHA1

54435ecd9efad8ac9d8938668487877136bbfbf8
SHA256

6302f08805736a80b939c7b4e226bc7c0201c8ea567f0aaa5ac058c87c6c829f
SHA512

42d88ee9adb8bad2c3e1651681e2111555a4f61781587c340295f29715905c1b76b0ee0ed37e281817cbdc655a62ee38bb1ee88081705cf1ddba47899598f731
SSDEEP

12288:4ormUG1wwQS2ijcSBC6nTSYkFzGC9055EnY/WAlibW4pBMLbN9vbu42oGHvAPIdI:4NUkQ5CTSYkFX9o5EnWllibZpBMvN5b3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
6302f08805736a80b939c7b4e226bc7c0201c8ea567f0aaa5ac058c87c6c829f.exe

Files

6302f08805736a80b939c7b4e226bc7c0201c8ea567f0aaa5ac058c87c6c829f.exe
.dll windows:6 windows x64 arch:x64

882e11ed7b405b18a8dee32efc241a90

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

uxtheme

DrawThemeParentBackgroundEx
IsCompositionActive
BufferedPaintSetAlpha
BeginBufferedPaint

usp10

ScriptItemizeOpenType
ScriptString_pLogAttr
ScriptGetCMap
ScriptItemize

msvfw32

ICSeqCompressFrame
DrawDibChangePalette
ICCompress
ICInstall
MCIWndRegisterClass
DrawDibStart

rasapi32

RasSetEntryDialParamsA
RasCreatePhonebookEntryA
RasGetEntryPropertiesW
RasDeleteEntryA
RasSetCredentialsA
RasSetAutodialAddressW
RasEnumConnectionsW

Exports

Exports

DOPP9WVBU
KJ9XyjZ
bN8zPE7Q3o
ijniuashdyguas
l2tDV9
q2R8PkOzLYj
s7Cjqy
smZtl7wc

Sections

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 654KB - Virtual size: 653KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ