file[.]exe | Triage™

General

Target
file.exe
Size 447KB
Sample230615-ypsxyaba64
SHA256 0ca15ac24cd26ecd4afb42b4c8802bcfc1eb06088ae0d3503fbc732f80429531
MD5 75a34d3bc5d01c45db6e3116c7d1fc80
SHA1 e42a9f9f74db70f8a2895c8b39e2d358ccb62482
SHA512 d899c07742e4fa13ab2c8bb1d020078738c221f183d21e0b77e62ffc63eb7592d2b169596c87ab660a2ba8e8145e25166d9654c36e8205ef422408b6e7b7a0ae
SSDEEP 12288:lLevbifhWuhXqzWUcY3SwAbbFiEjOryPKCtjs:lQot6zWUHSL5iEjiyCCe
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 447KB

file.exe

IMPHASH 99ae33530ebff97e88a1ac2c3129a9f7
SHA256 0ca15ac24cd26ecd4afb42b4c8802bcfc1eb06088ae0d3503fbc732f80429531
MD5 75a34d3bc5d01c45db6e3116c7d1fc80
SHA1 e42a9f9f74db70f8a2895c8b39e2d358ccb62482
SHA512 d899c07742e4fa13ab2c8bb1d020078738c221f183d21e0b77e62ffc63eb7592d2b169596c87ab660a2ba8e8145e25166d9654c36e8205ef422408b6e7b7a0ae
SSDEEP 12288:lLevbifhWuhXqzWUcY3SwAbbFiEjOryPKCtjs:lQot6zWUHSL5iEjiyCCe
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20429

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ConvertThreadToFiber GetConsoleAliasExesLengthA InterlockedIncrement InterlockedDecrement WaitNamedPipeA GetCurrentProcess SetMailslotInfo ZombifyActCtx GetModuleHandleW GetTickCount SetFileTime EnumTimeFormatsW GetVolumePathNameW GlobalAlloc GetSystemDirectoryW SetFileShortNameW GetSystemPowerStatus FreeConsole GetCalendarInfoA GetFileAttributesA SetSystemPowerState GetShortPathNameA EnumSystemLocalesA GetProcAddress MoveFileW SetProcessAffinityMask EnterCriticalSection SearchPathA GetDiskFreeSpaceW LoadLibraryA WriteConsoleA GetProcessId InterlockedExchangeAdd DeleteTimerQueue SetCalendarInfoW FindFirstVolumeMountPointW BeginUpdateResourceA AddAtomA GetPrivateProfileStructA FindNextFileA GetModuleHandleA OpenFileMappingW FreeEnvironmentStringsW GetCurrentDirectoryA GetShortPathNameW GetVolumeNameForVolumeMountPointW EnumCalendarInfoExA DeleteFileA SetComputerNameA ExitProcess WriteConsoleW HeapReAlloc GetLastError MoveFileA MultiByteToWideChar GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException HeapAlloc HeapFree IsProcessorFeaturePresent EncodePointer DecodePointer UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCPInfo GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId LeaveCriticalSection SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection CloseHandle WriteFile GetModuleFileNameW GetModuleFileNameA WideCharToMultiByte GetEnvironmentStringsW HeapCreate QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringW GetStringTypeW Sleep SetFilePointer GetConsoleCP GetConsoleMode RtlUnwind SetStdHandle FlushFileBuffers HeapSize LoadLibraryW CreateFileW

gdi32

SelectPalette

winhttp

WinHttpGetProxyForUrl

Sharing