file[.]exe | Triage™

General

Target
file.exe
Size 509KB
Sample230604-cgpdwsag22
SHA256 4d394ab71802f94b89ba5d62bdb2faebc5b500acbc2a362339ba451517710441
MD5 efdfe7b453335af07c2b47cc91655763
SHA1 1d43f1f050c68753d2a348d984a6514b84992ed8
SHA512 f27a1b8b5a5aa7414c984452cf65a1629eb0b6e1348639dfa746bdd1352e2907c7ca55500fd8b0e062562b9f36f7dbdec8ceb51d165de669898fcaad9db823b9
SSDEEP 12288:fj60x8RcGLqgAAbTrB6nOwYDAm5CaqP9:fjTccuq8bPB6nOXAmMb
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 509KB

file.exe

IMPHASH 08b56125ba7e99bd17ba88b830247aad
SHA256 4d394ab71802f94b89ba5d62bdb2faebc5b500acbc2a362339ba451517710441
MD5 efdfe7b453335af07c2b47cc91655763
SHA1 1d43f1f050c68753d2a348d984a6514b84992ed8
SHA512 f27a1b8b5a5aa7414c984452cf65a1629eb0b6e1348639dfa746bdd1352e2907c7ca55500fd8b0e062562b9f36f7dbdec8ceb51d165de669898fcaad9db823b9
SSDEEP 12288:fj60x8RcGLqgAAbTrB6nOwYDAm5CaqP9:fjTccuq8bPB6nOXAmMb
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

36350

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SearchPathW BuildCommDCBAndTimeoutsA InterlockedIncrement InterlockedDecrement SetMailslotInfo ZombifyActCtx GetProcessPriorityBoost GetModuleHandleW EnumCalendarInfoExW WaitNamedPipeW EnumTimeFormatsW GetDriveTypeA GetProcessTimes GetVolumePathNameW GetCalendarInfoA GetConsoleAliasExesLengthW GetFileAttributesA SetSystemPowerState GetModuleFileNameW CompareStringW GetShortPathNameA EnumSystemLocalesA GetPrivateProfileIntW GetProfileIntA HeapCompact GetLastError GetProcAddress AttachConsole SetComputerNameA EnterCriticalSection GlobalFree OpenWaitableTimerA LoadLibraryA WriteConsoleA GetProcessId InterlockedExchangeAdd LocalAlloc AddAtomA OpenJobObjectW GetPrivateProfileStructA FindFirstVolumeMountPointA EnumDateFormatsA CreateIoCompletionPort GetModuleHandleA CancelTimerQueueTimer FreeEnvironmentStringsW FindNextFileW CreateMailslotA SetCalendarInfoA AreFileApisANSI GlobalDeleteAtom DeleteFiber GetVolumeNameForVolumeMountPointA CloseHandle WriteConsoleW EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection LeaveCriticalSection WideCharToMultiByte HeapFree HeapAlloc DeleteFileA HeapReAlloc GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException RtlUnwind LCMapStringW MultiByteToWideChar GetCPInfo GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess IsProcessorFeaturePresent HeapCreate ExitProcess WriteFile GetStdHandle SetFilePointer SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType GetModuleFileNameA GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetLocaleInfoW HeapSize GetUserDefaultLCID GetLocaleInfoA IsValidLocale GetStringTypeW LoadLibraryW SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers CreateFileW

gdi32

GetCharABCWidthsA SelectObject

winhttp

WinHttpGetProxyForUrl

Sharing