file[.]exe | Triage™

General

Target
file.exe
Size 337KB
Sample230515-z56dmsac33
SHA256 c66bc7b7d3242a3da4dbe585b0672264363733f1ae0aa36f2688bc45a0ff5271
MD5 d31b33c37cc5fe53ee942177fe460854
SHA1 873fc3c8077e13f2934da5017a27a5ed80cede78
SHA512 295881add62a6ced36716407af533a3c142e00d0d1ef6816126ac43652af9cdb8a8e9a2285c77b37b9660c3d699f7bf512919d75073761d0e4734f0a20498ce6
SSDEEP 6144:rLEkuTORJYhuPPuSMsAdozSR8MKezmZ04IZhjtaXTyWxCuiuZ:nEkuTOD9PPunyzSKMKezmYyXGrFu
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 337KB

file.exe

IMPHASH c5a8b227667c5bf1f9b6dfc78dd05c3d
SHA256 c66bc7b7d3242a3da4dbe585b0672264363733f1ae0aa36f2688bc45a0ff5271
MD5 d31b33c37cc5fe53ee942177fe460854
SHA1 873fc3c8077e13f2934da5017a27a5ed80cede78
SHA512 295881add62a6ced36716407af533a3c142e00d0d1ef6816126ac43652af9cdb8a8e9a2285c77b37b9660c3d699f7bf512919d75073761d0e4734f0a20498ce6
SSDEEP 6144:rLEkuTORJYhuPPuSMsAdozSR8MKezmZ04IZhjtaXTyWxCuiuZ:nEkuTOD9PPunyzSKMKezmYyXGrFu
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

34363

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetDefaultCommConfigA SearchPathW EnumCalendarInfoA GetDriveTypeW AllocConsole GetProfileIntW GetConsoleAliasExesLengthA ReadConsoleA InterlockedDecrement GetProfileSectionA SetVolumeMountPointW FreeEnvironmentStringsA MoveFileWithProgressA GetModuleHandleW GetTickCount GetSystemTimeAsFileTime EnumTimeFormatsA GetUserDefaultLangID ActivateActCtx GetPrivateProfileIntA AddRefActCtx LoadLibraryW IsProcessInJob GetCalendarInfoA GetStringTypeExW GetFileAttributesW GetModuleFileNameW CreateFileW GetOverlappedResult CompareStringW GetVolumePathNameA EnumSystemLocalesA GetCurrentDirectoryW SetLastError GetProcAddress HeapSize MoveFileW SetComputerNameA GetTempFileNameA SetFileApisToOEM WriteConsoleA LocalAlloc SetCalendarInfoW RemoveDirectoryW BeginUpdateResourceA AddAtomA FindFirstVolumeMountPointA GetModuleHandleA lstrcatW FreeEnvironmentStringsW FindNextFileW WaitForDebugEvent SetThreadAffinityMask FileTimeToLocalFileTime GetVolumeNameForVolumeMountPointW DeleteFileW DeleteAtom DeleteFileA InterlockedIncrement EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLastError HeapFree GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException RtlUnwind HeapAlloc WideCharToMultiByte LCMapStringW MultiByteToWideChar GetCPInfo IsProcessorFeaturePresent HeapCreate ExitProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId WriteFile GetStdHandle GetModuleFileNameA GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType QueryPerformanceCounter GetCurrentProcessId GetLocaleInfoW GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID GetLocaleInfoA IsValidLocale GetStringTypeW HeapReAlloc GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer CloseHandle WriteConsoleW SetStdHandle

Sharing