file[.]exe | Triage™

General

Target
file.exe
Size 401KB
Sample230529-rwvlsacc27
SHA256 fd84fb6d3f652320b03c3b4b63529d6d80967949f95613067c45d64b93de7be7
MD5 95bc30cf058fafef3b3440e15e26b5b9
SHA1 3f0bb9bef3d30d6de706af1a48ca004d0f9275fe
SHA512 03f5e3b996735999aa64e5ff521eaff516241d133f6f77f573bd517d3e72b93bc851ef0414c06d0ccdfeef0a2297b702e5a9fdbea92e898147343b0eed4a6308
SSDEEP 6144:gnjufNTCSimbmfBzhAuCA6wdfu4K5QFmLYn0PvfFPxpFJQ:gnaTCQ6DTD6WW41rIv9xpFJQ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 401KB

file.exe

IMPHASH 0a261f793955a0334411687f62dd4035
SHA256 fd84fb6d3f652320b03c3b4b63529d6d80967949f95613067c45d64b93de7be7
MD5 95bc30cf058fafef3b3440e15e26b5b9
SHA1 3f0bb9bef3d30d6de706af1a48ca004d0f9275fe
SHA512 03f5e3b996735999aa64e5ff521eaff516241d133f6f77f573bd517d3e72b93bc851ef0414c06d0ccdfeef0a2297b702e5a9fdbea92e898147343b0eed4a6308
SSDEEP 6144:gnjufNTCSimbmfBzhAuCA6wdfu4K5QFmLYn0PvfFPxpFJQ:gnaTCQ6DTD6WW41rIv9xpFJQ
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

46016

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SearchPathW GetProfileIntW LoadResource InterlockedDecrement OpenSemaphoreA FreeEnvironmentStringsA GetProcessPriorityBoost EnumCalendarInfoExW EnumTimeFormatsA GetDriveTypeA GetPrivateProfileIntA GetVolumeInformationA GetConsoleAliasExesLengthW WriteConsoleW lstrcatA CompareStringW GetVolumePathNameA EnumSystemLocalesA DeleteFiber FindFirstFileA GetLastError GetCurrentDirectoryW GlobalFix SetComputerNameA ResetEvent GetLocalTime LoadLibraryA WriteConsoleA InterlockedExchangeAdd LocalAlloc SetFileApisToANSI QueryDosDeviceW AddAtomA SetSystemTime GetModuleFileNameA FindNextFileA FindFirstVolumeMountPointA EnumDateFormatsA GetModuleHandleA FreeEnvironmentStringsW GetShortPathNameW SetCalendarInfoA SetThreadAffinityMask TerminateJobObject MoveFileWithProgressW DeleteFileA LocalFileTimeToFileTime GetProcAddress GetVolumeNameForVolumeMountPointA WideCharToMultiByte InterlockedIncrement InterlockedExchange MultiByteToWideChar EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapFree HeapReAlloc GetCommandLineA HeapSetInformation GetStartupInfoW GetCPInfo RaiseException RtlUnwind HeapAlloc LCMapStringW GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetLastError GetCurrentThreadId UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess IsProcessorFeaturePresent HeapCreate SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType SetFilePointer CloseHandle ExitProcess WriteFile GetModuleFileNameW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetStringTypeW GetLocaleInfoW HeapSize GetUserDefaultLCID GetLocaleInfoA IsValidLocale GetConsoleCP GetConsoleMode SetStdHandle FlushFileBuffers LoadLibraryW CreateFileW

gdi32

GetCharABCWidthsW

Sharing