file[.]exe | Triage™

General

Target
file.exe
Size 360KB
Sample230524-j4earsbe36
SHA256 d698ff2e1f16f44726ec9056282bb17e80a1303be426156e70063f440ff882fc
MD5 aae8b8e27d688386fe8794adbb1fd545
SHA1 0f79c0e70061e8469ddb028657da32ea6b1c4d64
SHA512 963bd9718b5bf16f1b5cd62d0d663b081001d82341fcb97a8a292ed4d055c5e9bdd488c19794d0c7b61cd3ada3c8b5a93838564efb0066aa12fb50f1d36e4798
SSDEEP 3072:2v4Spq5z93rlRi4eARxSa1JjgORwaysdAfDl+0QQGEmnXie+beva1TFVXKLu5Qbm:5D5BhxTh+cdAL80SEWie+bIcvDwehYY
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 360KB

file.exe

IMPHASH 2be08f59009c044eb260e71538d506db
SHA256 d698ff2e1f16f44726ec9056282bb17e80a1303be426156e70063f440ff882fc
MD5 aae8b8e27d688386fe8794adbb1fd545
SHA1 0f79c0e70061e8469ddb028657da32ea6b1c4d64
SHA512 963bd9718b5bf16f1b5cd62d0d663b081001d82341fcb97a8a292ed4d055c5e9bdd488c19794d0c7b61cd3ada3c8b5a93838564efb0066aa12fb50f1d36e4798
SSDEEP 3072:2v4Spq5z93rlRi4eARxSa1JjgORwaysdAfDl+0QQGEmnXie+beva1TFVXKLu5Qbm:5D5BhxTh+cdAL80SEWie+bIcvDwehYY
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

39901

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VirtualQuery GetDefaultCommConfigW GetCommState GetConsoleAliasA InterlockedDecrement GetLogicalDriveStringsW CreateJobObjectW InterlockedCompareExchange AddConsoleAliasW WaitForSingleObjectEx GetProcessPriorityBoost GetTickCount GetConsoleAliasesLengthA GetConsoleTitleA GetWindowsDirectoryA CancelDeviceWakeupRequest WriteFile CreateActCtxW InitializeCriticalSection GlobalAlloc GetLocaleInfoW FatalAppExitW GetSystemWindowsDirectoryA GetVersionExW GetStringTypeExW GlobalFlags FindNextVolumeW AllocConsole ReplaceFileW IsDBCSLeadByte GetModuleFileNameW GetStdHandle OpenMutexW GetLastError ReadConsoleOutputCharacterA GetProcAddress AttachConsole VirtualAlloc GetTempFileNameA LoadLibraryA DnsHostnameToComputerNameA CreateFileMappingW IsSystemResumeAutomatic GetTapeParameters FindFirstVolumeMountPointA GetModuleHandleA GetConsoleTitleW WaitForDebugEvent SetProcessShutdownParameters _lopen FindAtomW AddConsoleAliasA PeekNamedPipe SetThreadContext lstrlenA MulDiv WideCharToMultiByte InterlockedIncrement InterlockedExchange MultiByteToWideChar Sleep DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapFree TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA GetStartupInfoA GetCPInfo RtlUnwind RaiseException LCMapStringW LCMapStringA GetStringTypeW HeapAlloc HeapCreate VirtualFree HeapReAlloc GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId ExitProcess GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetStringTypeA HeapSize GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale InitializeCriticalSectionAndSpinCount

user32

CharLowerBuffW

gdi32

GetCharWidthW GetCharABCWidthsFloatW EnumFontsA

Sharing