file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 477KB
Sample230501-vs4xtsgc55
SHA256 c3e4b936392928fd4e1190f3ce396efd4495f1132f8aad00aab1d2dceed6bda6
MD5 8e49c8a9fea42c8ec0315041c173401c
SHA1 172b13dfad0dc188d49b922532b6473abedd3255
SHA512 b213d9e696206e13a58a8c45ff9006c12f12a9cd1dee7629669fee90dda63929d71543a442cd0033f50fa3ab88bccd202f17cf6e824b5747d37c63e00f8bd6d0
SSDEEP 12288:ZjaaF2sTh5S3B8ZlNnYKF/DCeT2T8fltAPCH:oaF2eh5S3B8LNnhZT2T8flOPCH
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 477KB

file.exe

IMPHASH 606a690081d1bdedf2f5dc3cb5f1d4a4
SHA256 c3e4b936392928fd4e1190f3ce396efd4495f1132f8aad00aab1d2dceed6bda6
MD5 8e49c8a9fea42c8ec0315041c173401c
SHA1 172b13dfad0dc188d49b922532b6473abedd3255
SHA512 b213d9e696206e13a58a8c45ff9006c12f12a9cd1dee7629669fee90dda63929d71543a442cd0033f50fa3ab88bccd202f17cf6e824b5747d37c63e00f8bd6d0
SSDEEP 12288:ZjaaF2sTh5S3B8ZlNnYKF/DCeT2T8fltAPCH:oaF2eh5S3B8LNnhZT2T8flOPCH
MD5 SHA1 SHA512 SSDEEP

windows x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

176656

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

TraceMessage GetTraceLoggerHandle GetTraceEnableLevel GetTraceEnableFlags RegisterTraceGuidsW UnregisterTraceGuids RegCloseKey OpenSCManagerW OpenServiceW StartServiceW QueryServiceStatus CloseServiceHandle CheckTokenMembership RegNotifyChangeKeyValue SetSecurityDescriptorDacl AllocateAndInitializeSid RegCreateKeyExW CopySid IsValidSid RegSetValueExW OpenProcessToken FreeSid InitializeSecurityDescriptor InitializeAcl GetTokenInformation RegQueryValueExW AddAccessAllowedAce GetLengthSid RegDeleteValueW RegOpenKeyExW

kernel32

ReadConsoleW DecodePointer LoadLibraryExW SetWaitableTimer CreateWaitableTimerW CopyFileW DeleteFileW RemoveDirectoryW MoveFileExW GetTimeFormatW GetDateFormatW OutputDebugStringW IsDebuggerPresent EnterCriticalSection CloseHandle LeaveCriticalSection GetCommandLineW SetFileAttributesW HeapFree GetProcessHeap HeapAlloc GetCurrentProcess GetLastError Process32NextW GetCurrentProcessId Process32FirstW CreateToolhelp32Snapshot FreeLibrary SetEndOfFile FormatMessageW WideCharToMultiByte RaiseException MultiByteToWideChar QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW TerminateProcess GetModuleFileNameW GetProcAddress GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetACP SetLastError GetStringTypeW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW DeleteCriticalSection SetStdHandle GetFileType InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LCMapStringW HeapSize HeapReAlloc FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW CreateFileW EncodePointer CreateDirectoryW SizeofResource WaitForSingleObject GetSystemDirectoryW Sleep LockResource LoadResource FindResourceW GetCurrentDirectoryW CreateProcessW GetSystemWindowsDirectoryW ReadFile FindFirstFileW GetFileSizeEx GetFullPathNameW ExpandEnvironmentStringsW GetEnvironmentVariableW GetTempPathW GetFileAttributesW OpenProcess CreateEventW SetEvent HeapSetInformation LocalFree GetTickCount GetLocalTime VirtualLock WaitForMultipleObjects

ole32

CoCreateGuid

rpcrt4

UuidCreate

ntdll

RtlPcToFileHeader RtlGetVersion RtlLookupFunctionEntry RtlCaptureContext RtlNtStatusToDosError RtlVirtualUnwind RtlUnwindEx