file[.]exe | Triage™

General

Target
file.exe
Size 263KB
Sample230605-zleftabd2z
SHA256 4406711113df2e32ba7a4d0ca3befc8f2572646d6b48e494fd42633fed60e328
MD5 00e2db89532040c67ffd107ce99200ff
SHA1 ecfa050c622f9a8937c241f4612b18e71a10b37f
SHA512 e0db858ada8ab45ce009db7cdc3613496951cc9c27b68dec72586d68dbf605e43e9a4a616418710065a121046c8d03eb77b9131522677d1d1e527ce1b7e89b47
SSDEEP 3072:BgU/XdoE8Rk3EXyEx6lnortV5sEqirdUkx+uzyHvP0AwpRPfMvgpm9jDQi9j0dUR:WUVogdlqP5SLyyEVRPfMJQiUA
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 263KB

file.exe

IMPHASH a52b903201b2b26f84fa5c505e01f1fe
SHA256 4406711113df2e32ba7a4d0ca3befc8f2572646d6b48e494fd42633fed60e328
MD5 00e2db89532040c67ffd107ce99200ff
SHA1 ecfa050c622f9a8937c241f4612b18e71a10b37f
SHA512 e0db858ada8ab45ce009db7cdc3613496951cc9c27b68dec72586d68dbf605e43e9a4a616418710065a121046c8d03eb77b9131522677d1d1e527ce1b7e89b47
SSDEEP 3072:BgU/XdoE8Rk3EXyEx6lnortV5sEqirdUkx+uzyHvP0AwpRPfMvgpm9jDQi9j0dUR:WUVogdlqP5SLyyEVRPfMJQiUA
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

35793

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedDecrement WaitNamedPipeA SetMailslotInfo ZombifyActCtx QueryDosDeviceA GetProcessPriorityBoost GetModuleHandleW EnumTimeFormatsW GetDriveTypeA GetVolumePathNameW GetPrivateProfileStructW GetCalendarInfoW GetConsoleAliasExesLengthW GetFileAttributesW WriteConsoleW SetSystemPowerState GetModuleFileNameW CompareStringW GetShortPathNameA GetPrivateProfileIntW GetProfileIntA DeleteFiber GetLastError GetProcAddress AttachConsole InterlockedIncrement SearchPathA GlobalFree ResetEvent OpenWaitableTimerA LoadLibraryA GetProcessId InterlockedExchangeAdd LocalAlloc AddAtomW OpenJobObjectW SetSystemTime GlobalWire FindNextFileA FindFirstVolumeMountPointA EnumDateFormatsA CreateIoCompletionPort GetModuleHandleA FreeEnvironmentStringsW CreateMailslotA EnumDateFormatsW SetCalendarInfoA FileTimeToLocalFileTime EnumCalendarInfoExA EnumSystemLocalesW AreFileApisANSI GlobalDeleteAtom SetComputerNameA GetVolumeNameForVolumeMountPointA CreateFileW FlushFileBuffers EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection WideCharToMultiByte HeapFree HeapAlloc DeleteFileA HeapReAlloc GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException RtlUnwind LCMapStringW MultiByteToWideChar GetCPInfo GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess IsProcessorFeaturePresent HeapCreate ExitProcess WriteFile GetStdHandle SetFilePointer SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType GetModuleFileNameA GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetLocaleInfoW HeapSize GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeW GetConsoleCP GetConsoleMode LoadLibraryW SetStdHandle CloseHandle

gdi32

GetCharABCWidthsA SelectObject

winhttp

WinHttpGetProxyForUrl

Sharing