file[.]exe | Triage™

General

Target
file.exe
Size 449KB
Sample230616-bsdabscc43
SHA256 ad5fc45f2dd58b5209749b5b5f7aaac5b3413cea80eb200727fa1fd919bb8cf6
MD5 6c7eb9815cd703da377669b0ce8b296e
SHA1 346355d5e82b5fc0d98e7473b669e38a60d21650
SHA512 f778534ee852912125da09c92307492e565453f90cd1a9ae40c399dd19072f15d129f2e4c13db611348f4cf02534652da7be3994866c5ec1a4f00a55dc3f6946
SSDEEP 6144:96k5WC6JSxgZCHH+tIvZ73uPoZWqw3ebxI/h66swJDRUmiMUmLfkUoH:96uWCisH+tIJ2oBwMS/5JDaWUmL0
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 449KB

file.exe

IMPHASH a906842d3a12e68a8de3680faf4710f1
SHA256 ad5fc45f2dd58b5209749b5b5f7aaac5b3413cea80eb200727fa1fd919bb8cf6
MD5 6c7eb9815cd703da377669b0ce8b296e
SHA1 346355d5e82b5fc0d98e7473b669e38a60d21650
SHA512 f778534ee852912125da09c92307492e565453f90cd1a9ae40c399dd19072f15d129f2e4c13db611348f4cf02534652da7be3994866c5ec1a4f00a55dc3f6946
SSDEEP 6144:96k5WC6JSxgZCHH+tIvZ73uPoZWqw3ebxI/h66swJDRUmiMUmLfkUoH:96uWCisH+tIJ2oBwMS/5JDaWUmL0
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20429

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ConvertThreadToFiber GetConsoleAliasExesLengthA OpenJobObjectA InterlockedDecrement WaitNamedPipeA GetCurrentProcess SetMailslotInfo ZombifyActCtx FreeEnvironmentStringsA GetModuleHandleW GetTickCount EnumCalendarInfoExW SetFileTime EnumTimeFormatsW GetVolumePathNameW GlobalAlloc GetSystemDirectoryW SetFileShortNameW GetSystemPowerStatus GetCalendarInfoA GetFileAttributesA SetSystemPowerState TerminateProcess FindNextVolumeMountPointW EnumSystemLocalesA GetPrivateProfileIntW AllocConsole MoveFileW SetComputerNameA EnterCriticalSection SearchPathA GetDiskFreeSpaceW LoadLibraryA OpenThread WriteConsoleA GetProcessId InterlockedExchangeAdd OpenWaitableTimerW DeleteTimerQueue SetCalendarInfoW SetFileApisToANSI BeginUpdateResourceA AddAtomA GetPrivateProfileStructA FindNextFileA GetModuleHandleA OpenFileMappingW GetCurrentDirectoryA CompareStringA GetShortPathNameW GetVolumeNameForVolumeMountPointW SetFileAttributesW DeleteFileA GetProcAddress SetProcessAffinityMask WriteConsoleW HeapReAlloc GetLastError MoveFileA MultiByteToWideChar GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException HeapAlloc HeapFree IsProcessorFeaturePresent EncodePointer DecodePointer UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo InterlockedIncrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId LeaveCriticalSection SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection CloseHandle ExitProcess WriteFile GetModuleFileNameW GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringW GetStringTypeW Sleep SetFilePointer GetConsoleCP GetConsoleMode RtlUnwind SetStdHandle FlushFileBuffers HeapSize LoadLibraryW CreateFileW

gdi32

SelectPalette

winhttp

WinHttpGetProxyForUrl

Sharing