file[.]exe | Triage™

General

Target
file.exe
Size 417KB
Sample230510-pp2emshg21
SHA256 ace69ec865ded98976cddfe028ed70b5fa60a0fd5c01f1996ed160ecd3d5c859
MD5 41daa24b9867f03de306d5daaf63d0d9
SHA1 94b87c30fe89f24c784ec28eff61ee7bde7dbbf7
SHA512 aaa48735531dbe081e0d512d9f11c32a3ae76d30eb561e3c650a70d30406e7279f879532759cd4e53b857e76296b718d131e68b361d69afcee96a41c52d00912
SSDEEP 6144:7Rw2JV8O2v9YxeloPqAAfuyu/IsmvrHHbFv7C:m2JVvelozKuyu/IBL7Fv
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 417KB

file.exe

IMPHASH fec1eaf066374a71027605d8a122bd0e
SHA256 ace69ec865ded98976cddfe028ed70b5fa60a0fd5c01f1996ed160ecd3d5c859
MD5 41daa24b9867f03de306d5daaf63d0d9
SHA1 94b87c30fe89f24c784ec28eff61ee7bde7dbbf7
SHA512 aaa48735531dbe081e0d512d9f11c32a3ae76d30eb561e3c650a70d30406e7279f879532759cd4e53b857e76296b718d131e68b361d69afcee96a41c52d00912
SSDEEP 6144:7Rw2JV8O2v9YxeloPqAAfuyu/IsmvrHHbFv7C:m2JVvelozKuyu/IBL7Fv
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

35993

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetVolumeNameForVolumeMountPointA GlobalFix CreateFileA SetDefaultCommConfigA SetLocaleInfoA EnumCalendarInfoA GetDriveTypeW AllocConsole InterlockedIncrement SystemTimeToFileTime GetProfileSectionA GetUserDefaultLCID GetModuleHandleW GetTickCount ReadConsoleW TzSpecificLocalTimeToSystemTime SetHandleCount AllocateUserPhysicalPages GlobalAlloc GetPrivateProfileIntA AddRefActCtx SetFileShortNameW LoadLibraryW IsProcessInJob GetCalendarInfoW SetVolumeMountPointA GetConsoleAliasExesLengthW GetFileAttributesA GetFileAttributesW GetOverlappedResult GetVolumePathNameA GetStringTypeExA GetProfileIntA ReleaseActCtx SetLastError GetProcAddress SetComputerNameA SearchPathA GetTempFileNameA LoadLibraryA WriteConsoleA SetCalendarInfoW MoveFileA FindFirstVolumeMountPointW RemoveDirectoryW BeginUpdateResourceA AddAtomA GlobalWire GetModuleFileNameA FindNextFileA lstrcatW FreeEnvironmentStringsW GetConsoleTitleW GetCurrentDirectoryA EnumDateFormatsW CompareStringA SetThreadAffinityMask MoveFileWithProgressW DebugBreak EnumSystemLocalesW AreFileApisANSI DeleteFileA InterlockedDecrement EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLastError HeapFree ExitProcess GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException RtlUnwind HeapAlloc WideCharToMultiByte LCMapStringW MultiByteToWideChar GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess IsProcessorFeaturePresent HeapCreate SetFilePointer GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType HeapSize TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId GetLocaleInfoW WriteFile GetModuleFileNameW GetEnvironmentStringsW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetACP GetOEMCP IsValidCodePage GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeW HeapReAlloc SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers WriteConsoleW CloseHandle CreateFileW

Sharing