tmp[.]exe | Triage™

General

Target
tmp.exe
Size 470KB
Sample230523-ppf4psfc32
SHA256 0fcaad56c4f34a72d0fab48468d54e7d0dd2b87e843aa794c8e117d44c8dad93
MD5 81e1208ae8132eb999008c173bc886d7
SHA1 ccc6b3a50d4e788f90536d2f8c148f12c0b78850
SHA512 61c481f3b917f98b8a5b12728e46dbb7a248a6fcf1417e149edf332cf831b37217694b1e30737d2b6e4fc783a8f4fdecfefee74386412d97623c900220f97e7f
SSDEEP 6144:vhWyLn1o7eU9VSB+V5Tcyb+jAURmMfGp4IhB8AnlYxnNcZ8tDgJiw8rQAOH80J0K:plj1oyUvSlVtmMw3uxGeRXJOHt6uBS
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmp.exe

File Explorer

tmp.exe

.exe 470KB

tmp.exe

IMPHASH 8507dd6e83303e4881d265378980e13b
SHA256 0fcaad56c4f34a72d0fab48468d54e7d0dd2b87e843aa794c8e117d44c8dad93
MD5 81e1208ae8132eb999008c173bc886d7
SHA1 ccc6b3a50d4e788f90536d2f8c148f12c0b78850
SHA512 61c481f3b917f98b8a5b12728e46dbb7a248a6fcf1417e149edf332cf831b37217694b1e30737d2b6e4fc783a8f4fdecfefee74386412d97623c900220f97e7f
SSDEEP 6144:vhWyLn1o7eU9VSB+V5Tcyb+jAURmMfGp4IhB8AnlYxnNcZ8tDgJiw8rQAOH80J0K:plj1oyUvSlVtmMw3uxGeRXJOHt6uBS
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

30367

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetComputerNameW SetEvent SetTapeParameters GetModuleHandleW GetNumberFormatA ReadConsoleW FatalAppExitW GetCalendarInfoW HeapCreate GetConsoleAliasW LocalReAlloc ReplaceFileW GetModuleFileNameW CreateActCtxA lstrlenW GlobalUnlock GetStringTypeExA GetLastError IsDBCSLeadByteEx SetLastError GetProcAddress VirtualAlloc ReadFileEx InterlockedCompareExchange LoadLibraryA InterlockedExchangeAdd LocalAlloc DnsHostnameToComputerNameA FindFirstVolumeMountPointW IsSystemResumeAutomatic BeginUpdateResourceA GetModuleHandleA QueryMemoryResourceNotification GetProcessAffinityMask GetConsoleTitleW GetConsoleCursorInfo OpenEventW SetProcessShutdownParameters FindAtomW GetWindowsDirectoryW AddConsoleAliasA GetTempPathA EnumCalendarInfoExA FindNextVolumeA EnumSystemLocalesW LCMapStringW GetLogicalDriveStringsW WriteConsoleOutputW GetDefaultCommConfigW TlsGetValue SetThreadContext GetConsoleAliasesLengthW GetTempFileNameA InterlockedIncrement InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapAlloc MultiByteToWideChar GetStartupInfoW RaiseException RtlUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter HeapFree TerminateProcess GetCurrentProcess IsDebuggerPresent VirtualFree HeapReAlloc ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetCPInfo GetACP GetOEMCP IsValidCodePage TlsAlloc TlsSetValue TlsFree GetCurrentThreadId FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapSize GetLocaleInfoA GetStringTypeA GetStringTypeW InitializeCriticalSectionAndSpinCount LCMapStringA WideCharToMultiByte

user32

DdeQueryStringW GetClassInfoExW CreateAcceleratorTableA ChangeMenuW

gdi32

GetCharABCWidthsI GetCharABCWidthsFloatW GetCharWidthW EnumFontsA

advapi32

BackupEventLogA

Sharing