file[.]exe | Triage™

General

Target
file.exe
Size 327KB
Sample230616-cgn35acb9t
SHA256 441bb4d4e051b2c79398a8cd8aa996a8694c6ddc8ac8b1442c69c469f4cb74b5
MD5 c0f1ad8e4509bf82f5d9a2dad26007a2
SHA1 272521fc0cca11d57de27bbee8e82735cf2354aa
SHA512 b0fbd7a877dd4ed579f6969428b0a05066cfcd5bff4066f2af075a19aa36b316d98df137a078958e1239bbd794ee19e3e89475f55287f973c283d88661306dd4
SSDEEP 6144:omycZaHdH+0eqGTFE5LlGTy1Ak3tKxz6am099crDoH:omhZa9reqOE5LlGTyfPw
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 327KB

file.exe

IMPHASH a906842d3a12e68a8de3680faf4710f1
SHA256 441bb4d4e051b2c79398a8cd8aa996a8694c6ddc8ac8b1442c69c469f4cb74b5
MD5 c0f1ad8e4509bf82f5d9a2dad26007a2
SHA1 272521fc0cca11d57de27bbee8e82735cf2354aa
SHA512 b0fbd7a877dd4ed579f6969428b0a05066cfcd5bff4066f2af075a19aa36b316d98df137a078958e1239bbd794ee19e3e89475f55287f973c283d88661306dd4
SSDEEP 6144:omycZaHdH+0eqGTFE5LlGTy1Ak3tKxz6am099crDoH:omhZa9reqOE5LlGTyfPw
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20445

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ConvertThreadToFiber GetConsoleAliasExesLengthA OpenJobObjectA InterlockedDecrement WaitNamedPipeA GetCurrentProcess SetMailslotInfo ZombifyActCtx FreeEnvironmentStringsA GetModuleHandleW GetTickCount EnumCalendarInfoExW SetFileTime EnumTimeFormatsW GetVolumePathNameW GlobalAlloc GetSystemDirectoryW SetFileShortNameW GetSystemPowerStatus GetCalendarInfoA GetFileAttributesA SetSystemPowerState TerminateProcess FindNextVolumeMountPointW EnumSystemLocalesA GetPrivateProfileIntW AllocConsole MoveFileW SetComputerNameA EnterCriticalSection SearchPathA GetDiskFreeSpaceW LoadLibraryA OpenThread WriteConsoleA GetProcessId InterlockedExchangeAdd OpenWaitableTimerW DeleteTimerQueue SetCalendarInfoW SetFileApisToANSI BeginUpdateResourceA AddAtomA GetPrivateProfileStructA FindNextFileA GetModuleHandleA OpenFileMappingW GetCurrentDirectoryA CompareStringA GetShortPathNameW GetVolumeNameForVolumeMountPointW SetFileAttributesW DeleteFileA GetProcAddress SetProcessAffinityMask WriteConsoleW HeapReAlloc GetLastError MoveFileA MultiByteToWideChar GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException HeapAlloc HeapFree IsProcessorFeaturePresent EncodePointer DecodePointer UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo InterlockedIncrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId LeaveCriticalSection SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection CloseHandle ExitProcess WriteFile GetModuleFileNameW GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringW GetStringTypeW Sleep SetFilePointer GetConsoleCP GetConsoleMode RtlUnwind SetStdHandle FlushFileBuffers HeapSize LoadLibraryW CreateFileW

gdi32

SelectPalette

winhttp

WinHttpGetProxyForUrl

Sharing