file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 210KB
Sample230522-vlthhsbe79
SHA256 0fbeaa3d0492f83c2351aa8f91c429f063700d1fee4aa355e439c0862f6bb41f
MD5 b44b3fd2f45d55238c7e11df70148a9f
SHA1 63134b1cb8aba77efe75d73a748a72c1621fb07d
SHA512 ec922317ce92a5d20c617e03fd1566bedfec645f2105eb351a8dbf007ee8560f043e7f6123cf8acc1e9a1e7da2bf066b31f0bc1e77fbbc4a50b70cb9fd2f5607
SSDEEP 3072:OPVosEAHkKqUa9antF5hvvJkeXp2QhHkKqUa9antF5hvvJkeXpx:uHEKq99UF5hvvfjhEKq99UF5hvvf
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 210KB

file.exe

IMPHASH b5bfd9f5c740d22e228bf934c6651a65
SHA256 0fbeaa3d0492f83c2351aa8f91c429f063700d1fee4aa355e439c0862f6bb41f
MD5 b44b3fd2f45d55238c7e11df70148a9f
SHA1 63134b1cb8aba77efe75d73a748a72c1621fb07d
SHA512 ec922317ce92a5d20c617e03fd1566bedfec645f2105eb351a8dbf007ee8560f043e7f6123cf8acc1e9a1e7da2bf066b31f0bc1e77fbbc4a50b70cb9fd2f5607
SSDEEP 3072:OPVosEAHkKqUa9antF5hvvJkeXp2QhHkKqUa9antF5hvvJkeXpx:uHEKq99UF5hvvfjhEKq99UF5hvvf
MD5 SHA1 SHA512 SSDEEP

windows x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

29452

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegOpenKeyExW RegEnumKeyW RegCloseKey RegQueryValueExW RegSetValueExW

kernel32

Sleep SetEvent GetDriveTypeW FormatMessageW GetWindowsDirectoryW CreateThread GetDiskFreeSpaceW GetVolumeInformationW FreeLibrary LoadLibraryExW GetProcessHeap HeapFree lstrlenW GetTickCount CheckElevationEnabled GetModuleFileNameW GetLastError LocalFree HeapSetInformation CreateEventW CloseHandle WaitForSingleObject GetDiskFreeSpaceExW GetCommandLineW SetErrorMode GetStartupInfoA GetModuleHandleW MulDiv WideCharToMultiByte LocalAlloc RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter GetCurrentProcess TerminateProcess GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId QueryPerformanceCounter SetUnhandledExceptionFilter HeapAlloc GetVolumeNameForVolumeMountPointW

gdi32

GetLayout ExtTextOutW SetBkMode SetTextColor SetBkColor GetTextExtentPoint32W

user32

MessageBoxW ShowWindow SetFocus SendMessageW GetDlgItem EndDialog DialogBoxParamW DestroyWindow CreateDialogParamW IsDialogMessageW LoadStringW LoadIconW GetWindowLongPtrW EnableWindow GetWindowLongW GetSystemMetrics SetWindowLongPtrW GetClientRect SetDlgItemTextW EnumWindows DispatchMessageW TranslateMessage PeekMessageW GetSysColor SetForegroundWindow GetWindowTextW DrawFocusRect DestroyIcon DrawIconEx GetParent PostMessageW SendDlgItemMessageW

msvcrt

__set_app_type _fmode _commode ?terminate@@YAXXZ memset __setusermatherr _amsg_exit _initterm exit _cexit _exit _XcptFilter __C_specific_handler __getmainargs _vsnwprintf toupper _wcsicmp

ntdll

NtOpenProcessToken NtClose NtOpenThreadToken RtlNtStatusToDosError WinSqmAddToStream NtQueryInformationToken

ole32

CoTaskMemAlloc CoInitialize CoUninitialize CLSIDFromString CoTaskMemFree CoCreateInstance CoInitializeEx

shlwapi

StrStrIW StrToIntW StrCmpW StrCmpNW PathStripToRootW ord271 StrFormatByteSizeW ord487 SHDeleteKeyW

shell32

ShellExecuteExW SHGetFileInfoW ExtractIconExW ord680

vssapi

CreateVssBackupComponentsInternal VssFreeSnapshotPropertiesInternal