file[.]exe | Triage™

General

Target
file.exe
Size 390KB
Sample230515-back3sgd7v
SHA256 449b58af2fe540952c6ea157c40d057c6f222c852758e0ac4e7ee8fb1e4bbe1c
MD5 c3aa8389403bc22429cdabf0d94b6801
SHA1 317061e661ec85bf54e9eab5b6bcea788bbd9715
SHA512 a287e089b264caebb25bf910349a3be6feb4f8a9f53f3d7d1e945d8ec9dda823c10dc1b754297d3589cb567cb57df140448c8e46db91e36c3b716b61dc50ffd6
SSDEEP 6144:b8ut4BKMLdTTZCdFV88m2u47O0HdTwf65MOZ6d/obViSAwplbBtc:b8FBKMxTTYno2ucpHd8eMOZOSAw/Bt
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 390KB

file.exe

IMPHASH 1952ea510032cb3f71e8e7073aa425fe
SHA256 449b58af2fe540952c6ea157c40d057c6f222c852758e0ac4e7ee8fb1e4bbe1c
MD5 c3aa8389403bc22429cdabf0d94b6801
SHA1 317061e661ec85bf54e9eab5b6bcea788bbd9715
SHA512 a287e089b264caebb25bf910349a3be6feb4f8a9f53f3d7d1e945d8ec9dda823c10dc1b754297d3589cb567cb57df140448c8e46db91e36c3b716b61dc50ffd6
SSDEEP 6144:b8ut4BKMLdTTZCdFV88m2u47O0HdTwf65MOZ6d/obViSAwplbBtc:b8FBKMxTTYno2ucpHd8eMOZOSAw/Bt
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

34926

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedCompareExchange SetComputerNameW SetEvent SetTapeParameters GetModuleHandleW GetConsoleAliasesA GetNumberFormatA ReadConsoleW FatalAppExitW GetCalendarInfoW GetSystemWindowsDirectoryA HeapCreate FindNextVolumeW GetConsoleAliasW LocalReAlloc ReplaceFileW GetModuleFileNameW CreateActCtxA lstrlenW GlobalUnlock GetStringTypeExA GetLastError IsDBCSLeadByteEx SetLastError GetProcAddress VirtualAlloc CancelWaitableTimer ReadFileEx GetTempFileNameA LoadLibraryA InterlockedExchangeAdd LocalAlloc DnsHostnameToComputerNameA FindFirstVolumeMountPointW IsSystemResumeAutomatic BeginUpdateResourceA QueryDosDeviceW GetModuleHandleA QueryMemoryResourceNotification GetProcessAffinityMask GetConsoleTitleW GetConsoleCursorInfo OpenEventW SetProcessShutdownParameters FindAtomW GetWindowsDirectoryW AddConsoleAliasA EnumCalendarInfoExA FindNextVolumeA EnumSystemLocalesW LCMapStringW WideCharToMultiByte GetLogicalDriveStringsW SetThreadContext WriteConsoleOutputW GetDefaultCommConfigW TlsGetValue GetConsoleAliasesLengthW CreateJobSet InterlockedIncrement InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapAlloc MultiByteToWideChar GetStartupInfoW RaiseException RtlUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter HeapFree TerminateProcess GetCurrentProcess IsDebuggerPresent VirtualFree HeapReAlloc ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetCPInfo GetACP GetOEMCP IsValidCodePage TlsAlloc TlsSetValue TlsFree GetCurrentThreadId FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapSize GetLocaleInfoA GetStringTypeA GetStringTypeW InitializeCriticalSectionAndSpinCount LCMapStringA

user32

GetParent DdeQueryStringW GetClassInfoExW CreateAcceleratorTableA ChangeMenuW

gdi32

GetCharABCWidthsI GetCharABCWidthsFloatW EnumFontsA GetCharWidthW

advapi32

BackupEventLogA

Sharing