file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 460KB
Sample230616-s2f61sff47
SHA256 4c313f3f72094ea68a3e98db6778ce4ce9f38d3ba22e3b4b752a7a95679b1b70
MD5 0f01ee95905898526104bac8d0b3339b
SHA1 146d9ebb83bf9ced19564f8ab050cb3d576ab832
SHA512 977dc30954fd62bbad0c694895dd36c6103c49e208bc897599a3e957e27f96ab3ef8d77cb20375fae86aed56bb84feea6f600c6f367aa2664714f5275b48c790
SSDEEP 3072:V3dy1s3sQZ1SG4G668CAGn++Qas77fsi7anwZHbD2AHDKL6JYrLvfiwRcybXd/s:fsQl4rGnAas74tnYhDKDvfdBbXTVBl
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 460KB

file.exe

IMPHASH 2ab0162bfd91ce0b6db4856e4b4f264d
SHA256 4c313f3f72094ea68a3e98db6778ce4ce9f38d3ba22e3b4b752a7a95679b1b70
MD5 0f01ee95905898526104bac8d0b3339b
SHA1 146d9ebb83bf9ced19564f8ab050cb3d576ab832
SHA512 977dc30954fd62bbad0c694895dd36c6103c49e208bc897599a3e957e27f96ab3ef8d77cb20375fae86aed56bb84feea6f600c6f367aa2664714f5275b48c790
SSDEEP 3072:V3dy1s3sQZ1SG4G668CAGn++Qas77fsi7anwZHbD2AHDKL6JYrLvfiwRcybXd/s:fsQl4rGnAas74tnYhDKDvfdBbXTVBl
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

33679

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SystemTimeToFileTime ReadConsoleA InterlockedDecrement AddConsoleAliasW GetComputerNameW GetTickCount GetConsoleAliasesA GetConsoleTitleA CreateActCtxW CreateDirectoryExW SetProcessPriorityBoost GetCalendarInfoA FormatMessageW WriteConsoleOutputA FindNextVolumeW WriteConsoleW ReadFile GetModuleFileNameW GetLogicalDriveStringsA GetLastError SetLastError ReadConsoleOutputCharacterA GetProcAddress VirtualAlloc FindResourceExW IsValidCodePage LoadLibraryA CreateHardLinkW SetCurrentDirectoryW GlobalHandle WaitForMultipleObjects GetOEMCP GetModuleHandleA QueryMemoryResourceNotification VirtualProtect GetCurrentDirectoryA OpenEventW FindFirstVolumeA GetVersionExA FindAtomW GetCurrentProcessId OpenFileMappingA CommConfigDialogW CreateThread GetConsoleOutputCP WriteConsoleA GetProcessHeap SetEndOfFile GetLocaleInfoA GetConsoleAliasExesA CreateTimerQueue BeginUpdateResourceW LocalUnlock SetFilePointer SetStdHandle FlushFileBuffers GetConsoleMode GetConsoleCP GetLocaleInfoW InterlockedIncrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapFree TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent MultiByteToWideChar GetCommandLineA GetStartupInfoA RtlUnwind RaiseException LCMapStringA WideCharToMultiByte LCMapStringW GetCPInfo HeapAlloc HeapCreate VirtualFree HeapReAlloc GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId HeapSize ExitProcess GetACP WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetSystemTimeAsFileTime GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW InitializeCriticalSectionAndSpinCount CloseHandle CreateFileA

user32

CharLowerBuffW CharToOemBuffW GetCaretPos LoadMenuW CharUpperBuffA

gdi32

GetTextExtentExPointA

advapi32

ReportEventA ReadEventLogW

ole32

CoGetPSClsid

winhttp

WinHttpCheckPlatform WinHttpSetDefaultProxyConfiguration WinHttpOpen

msimg32

TransparentBlt