file[.]exe | Triage™

General

Target
file.exe
Size 315KB
Sample230602-emcndsab6x
SHA256 ab668ffa972749b30c70726bc9b3818b21f51999778c6a2617b96e99ea5e2c0e
MD5 17d60a68b9f734a450f480b4a888b075
SHA1 5059c56e0e0a3fef2516bbcfa7fbb789f2c45c68
SHA512 3f982f2827ec2c8a445020a4119cc7cacdd0dee99e1243e86cd1c27207b2ec42903436050f171a393d40390be1c79180228223f4446909a62cfa7157f58672a1
SSDEEP 3072:pX1odt3B8inItXSWlMCGtH4MK0mg2bb+VEABaI5ISa9nT33Vi5F6mIkMy/YOO5mf:NRDPuCrDP+cSqTHVi59/Bf
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 315KB

file.exe

IMPHASH 8f27cfef510114068cda84f548448738
SHA256 ab668ffa972749b30c70726bc9b3818b21f51999778c6a2617b96e99ea5e2c0e
MD5 17d60a68b9f734a450f480b4a888b075
SHA1 5059c56e0e0a3fef2516bbcfa7fbb789f2c45c68
SHA512 3f982f2827ec2c8a445020a4119cc7cacdd0dee99e1243e86cd1c27207b2ec42903436050f171a393d40390be1c79180228223f4446909a62cfa7157f58672a1
SSDEEP 3072:pX1odt3B8inItXSWlMCGtH4MK0mg2bb+VEABaI5ISa9nT33Vi5F6mIkMy/YOO5mf:NRDPuCrDP+cSqTHVi59/Bf
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

25650

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WaitForSingleObject AddConsoleAliasW GetCurrentThread GetConsoleAliasesA IsBadReadPtr GetNumberFormatA FindResourceExA GlobalAlloc AddRefActCtx GetLocaleInfoW GetCalendarInfoW FreeConsole CreateEventA FindNextVolumeW GetModuleFileNameW ReplaceFileA DeactivateActCtx GetLogicalDriveStringsA OpenMutexW GetLastError GetConsoleAliasesLengthW ChangeTimerQueueTimer ReadConsoleOutputCharacterA GetProcAddress AttachConsole VirtualAlloc VirtualAllocEx LoadLibraryA InterlockedExchangeAdd GetConsoleScreenBufferInfo WritePrivateProfileStringA FindFirstVolumeMountPointW GetCurrentConsoleFont GetModuleFileNameA lstrcmpiW GetModuleHandleA GetCommTimeouts GetVersionExA FindAtomW DebugBreak OpenFileMappingA CreateFileA WritePrivateProfileStructA CreateMutexW GetCurrentDirectoryW GetDateFormatW HeapFree GetCommandLineA GetStartupInfoA RaiseException RtlUnwind TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer CloseHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle

user32

RegisterClassW CharLowerBuffA

gdi32

GetBkMode GetCharABCWidthsFloatA GetCharWidthW

Sharing