file[.]exe | Triage™

General

Target
file.exe
Size 323KB
Sample230515-3g43fsaf25
SHA256 c00935c3d68d60908b67b83aba7887c4c9b214028af047f1444e2cbc4626ed87
MD5 35be87057266fcf1ce58be0b55a91b7c
SHA1 d5971af9346a39da516691ade776dec6c7493726
SHA512 ab518d7383d10e2c8bd46cedc21914b2b5950e269591ce8a6b4ea444d3d33e33753643c69789167efd1f8b43c7b0a694874e65719f239daf8db369bed55d2ef4
SSDEEP 6144:EWGQyfwGoGU0JdIluWe/iYDvb67B7B3thPL1YJsv1/ZvcZ:tGQyoYdIluWe/JDYRDPL1YC9/Zvc
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 323KB

file.exe

IMPHASH ebf7184bb6162fe904521ab3f9260f90
SHA256 c00935c3d68d60908b67b83aba7887c4c9b214028af047f1444e2cbc4626ed87
MD5 35be87057266fcf1ce58be0b55a91b7c
SHA1 d5971af9346a39da516691ade776dec6c7493726
SHA512 ab518d7383d10e2c8bd46cedc21914b2b5950e269591ce8a6b4ea444d3d33e33753643c69789167efd1f8b43c7b0a694874e65719f239daf8db369bed55d2ef4
SSDEEP 6144:EWGQyfwGoGU0JdIluWe/iYDvb67B7B3thPL1YJsv1/ZvcZ:tGQyoYdIluWe/JDYRDPL1YC9/Zvc
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

34203

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetDefaultCommConfigA SearchPathW EnumCalendarInfoA GetDriveTypeW AllocConsole GetProfileIntW GetConsoleAliasExesLengthA InterlockedDecrement GetProfileSectionA SetVolumeMountPointW FreeEnvironmentStringsA MoveFileWithProgressA GetTickCount GetSystemTimeAsFileTime EnumTimeFormatsA GetUserDefaultLangID ActivateActCtx GetPrivateProfileIntA AddRefActCtx LoadLibraryW IsProcessInJob GetCalendarInfoA GetStringTypeExW GetFileAttributesW GetModuleFileNameW CreateFileW GetOverlappedResult CompareStringW GetVolumePathNameA EnumSystemLocalesA GetCurrentDirectoryW SetLastError GetProcAddress HeapSize SetComputerNameA GetTempFileNameA SetFileApisToOEM WriteConsoleA LocalAlloc SetCalendarInfoW RemoveDirectoryW BeginUpdateResourceA AddAtomA FindFirstVolumeMountPointA GetModuleHandleA lstrcatW FreeEnvironmentStringsW FindNextFileW SetThreadAffinityMask FileTimeToLocalFileTime GetVolumeNameForVolumeMountPointW DeleteFileW DeleteAtom DeleteFileA InterlockedIncrement EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLastError HeapFree GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException RtlUnwind HeapAlloc WideCharToMultiByte LCMapStringW MultiByteToWideChar GetCPInfo IsProcessorFeaturePresent HeapCreate GetModuleHandleW ExitProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId WriteFile GetStdHandle GetModuleFileNameA GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType QueryPerformanceCounter GetCurrentProcessId GetLocaleInfoW GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID GetLocaleInfoA IsValidLocale GetStringTypeW HeapReAlloc GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer CloseHandle WriteConsoleW SetStdHandle

Sharing