file[.]exe | Triage™

General

Target
file.exe
Size 317KB
Sample230615-xa7bcaag66
SHA256 65e415cb9fd742853af3e2d0dda418adb799d61e8a8a806d2d28802c4f8975d0
MD5 cf83940906d481ea29eb98521ddeec94
SHA1 6ec4c0a4fb752f8f07dced79d85e68160b8eeea1
SHA512 860b970f9e16a35b69b5d5e78ff397010c6bdebb46f553bb678e06e8be176c81153cc2ecfe5bb82c83e27805d632620456f8aae7ad1b613f43940a60af8342f8
SSDEEP 6144:iRp4W8XS+i+AUBv4x2LwlUrL+PJEr9xGyMqSoH:iEW8pLfo2b+BEzGO
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 317KB

file.exe

IMPHASH a5471e9b5a4d51109b645937067bcab0
SHA256 65e415cb9fd742853af3e2d0dda418adb799d61e8a8a806d2d28802c4f8975d0
MD5 cf83940906d481ea29eb98521ddeec94
SHA1 6ec4c0a4fb752f8f07dced79d85e68160b8eeea1
SHA512 860b970f9e16a35b69b5d5e78ff397010c6bdebb46f553bb678e06e8be176c81153cc2ecfe5bb82c83e27805d632620456f8aae7ad1b613f43940a60af8342f8
SSDEEP 6144:iRp4W8XS+i+AUBv4x2LwlUrL+PJEr9xGyMqSoH:iEW8pLfo2b+BEzGO
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20413

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ConvertThreadToFiber GetConsoleAliasExesLengthA InterlockedIncrement InterlockedDecrement WaitNamedPipeA GetCurrentProcess SetMailslotInfo ZombifyActCtx GetModuleHandleW GetTickCount SetFileTime EnumTimeFormatsW GlobalAlloc GetSystemDirectoryW SetFileShortNameW GetSystemPowerStatus FreeConsole GetCalendarInfoA GetFileAttributesA SetSystemPowerState GetVolumePathNameA GetShortPathNameA EnumSystemLocalesA GetProcAddress MoveFileW SetProcessAffinityMask EnterCriticalSection SearchPathA LoadLibraryA WriteConsoleA GetProcessId InterlockedExchangeAdd DeleteTimerQueue SetCalendarInfoW FindFirstVolumeMountPointW BeginUpdateResourceA GetDiskFreeSpaceA AddAtomA GetPrivateProfileStructA FindNextFileA GetModuleHandleA OpenFileMappingW FreeEnvironmentStringsW GetCurrentDirectoryA GetShortPathNameW GetVolumeNameForVolumeMountPointW EnumCalendarInfoExA DeleteFileA SetComputerNameA ExitProcess WriteConsoleW HeapReAlloc GetLastError MoveFileA MultiByteToWideChar GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException HeapAlloc HeapFree IsProcessorFeaturePresent EncodePointer DecodePointer UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCPInfo GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId LeaveCriticalSection SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection CloseHandle WriteFile GetModuleFileNameW GetModuleFileNameA WideCharToMultiByte GetEnvironmentStringsW HeapCreate QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringW GetStringTypeW Sleep SetFilePointer GetConsoleCP GetConsoleMode RtlUnwind SetStdHandle FlushFileBuffers HeapSize LoadLibraryW CreateFileW

gdi32

SelectPalette

winhttp

WinHttpGetProxyForUrl

Sharing