file[.]exe | Triage™

General

Target
file.exe
Size 234KB
Sample230602-bex3kshb95
SHA256 ec966fb9a431938c200f620cc5366bbbeed1919d4650ccb1b29b79b3862f3b43
MD5 ae00d115ff7257a976abe13c6fb2010a
SHA1 7ec339a4457bf7b42ae4844bb2fa237f730b1d0a
SHA512 995a12503fa0a4ecb3a780c9cc80f80763e74e1e288c206f45316251cef02dc6fdd61393c73c8b000392199171cf6c6e7d32dc9b126b30e7a7e0f5664315133d
SSDEEP 3072:lXjU/t0GwZzeWVsAxzqslspnvaFgwW9lFgXPWpye5TST:husV/xzqsknv8W9LtygS
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 234KB

file.exe

IMPHASH b9512067b0ff2431debec33d2434e6e7
SHA256 ec966fb9a431938c200f620cc5366bbbeed1919d4650ccb1b29b79b3862f3b43
MD5 ae00d115ff7257a976abe13c6fb2010a
SHA1 7ec339a4457bf7b42ae4844bb2fa237f730b1d0a
SHA512 995a12503fa0a4ecb3a780c9cc80f80763e74e1e288c206f45316251cef02dc6fdd61393c73c8b000392199171cf6c6e7d32dc9b126b30e7a7e0f5664315133d
SSDEEP 3072:lXjU/t0GwZzeWVsAxzqslspnvaFgwW9lFgXPWpye5TST:husV/xzqsknv8W9LtygS
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

25154

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WaitForSingleObject AddConsoleAliasW GetCurrentThread GetConsoleAliasesA IsBadReadPtr GetNumberFormatA FindResourceExA GlobalAlloc AddRefActCtx GetLocaleInfoW GetCalendarInfoW FreeConsole CreateEventA FindNextVolumeW GetModuleFileNameW ReplaceFileA DeactivateActCtx GetLogicalDriveStringsA OpenMutexW GetLastError GetConsoleAliasesLengthW ChangeTimerQueueTimer ReadConsoleOutputCharacterA GetProcAddress AttachConsole VirtualAlloc VirtualAllocEx LoadLibraryA InterlockedExchangeAdd GetConsoleScreenBufferInfo WritePrivateProfileStringA FindFirstVolumeMountPointW GetCurrentConsoleFont GetModuleFileNameA lstrcmpiW GetModuleHandleA GetCommTimeouts GetVersionExA FindAtomW DebugBreak OpenFileMappingA WritePrivateProfileStructA CreateMutexW GetCurrentDirectoryW GetDateFormatW HeapFree GetCommandLineA GetStartupInfoA RaiseException RtlUnwind TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA

user32

RegisterClassW CharLowerBuffA

gdi32

GetBkMode GetCharABCWidthsFloatA GetCharWidthW

Sharing