file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 313KB
Sample230628-y285paba25
SHA256 5b8e096d71a9cd1a4847871083e473b2828eb2aabe0acdba82e722d0bb2e11c3
MD5 99fb11d82569a087ad64101af0de80f2
SHA1 aacea1e9a73ee15f94565a8a4bb5e69367da19fb
SHA512 b79da8a91f3929d26fee65267176a03e968d767c96e144eafa8b058fc1abdf9a83cd24252b34dac6d3ef9439b657f5c867e6e4fe7b9441c76b4bdf8fc1ae7af8
SSDEEP 3072:E8kUTMYQ0qIN6NtVcOXVK5UMJ2LUPj3keyRS6CSfKVu1xgCAWU8fvJqxEm4x1ES1:DMnt3VPCJPjsp/1fvoxEvTE
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 313KB

file.exe

IMPHASH a7a19cad0c2c193feb43fc00c1b6b502
SHA256 5b8e096d71a9cd1a4847871083e473b2828eb2aabe0acdba82e722d0bb2e11c3
MD5 99fb11d82569a087ad64101af0de80f2
SHA1 aacea1e9a73ee15f94565a8a4bb5e69367da19fb
SHA512 b79da8a91f3929d26fee65267176a03e968d767c96e144eafa8b058fc1abdf9a83cd24252b34dac6d3ef9439b657f5c867e6e4fe7b9441c76b4bdf8fc1ae7af8
SSDEEP 3072:E8kUTMYQ0qIN6NtVcOXVK5UMJ2LUPj3keyRS6CSfKVu1xgCAWU8fvJqxEm4x1ES1:DMnt3VPCJPjsp/1fvoxEvTE
MD5 SHA1 SHA512 SSDEEP

windows x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

68660

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey EventWrite EventRegister EventUnregister RegCreateKeyExW RegSetValueExW

kernel32

GetLastError HeapFree GetProcessHeap HeapAlloc GetCurrentThreadId GetTickCount QueryPerformanceCounter GetModuleHandleW SetUnhandledExceptionFilter GetStartupInfoW Sleep LocalFree GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext CreateMutexW GetTickCount64 VerifyVersionInfoW VerSetConditionMask MulDiv CloseHandle GetCurrentProcessId

gdi32

Polyline SetBkColor CreateSolidBrush CreatePen DeleteObject GetDeviceCaps CreateFontIndirectW GetObjectW CreateCompatibleDC SelectObject GdiAlphaBlend BitBlt DeleteDC GetStockObject GdiSetBatchLimit SetTextColor GetTextMetricsW PatBlt CreateCompatibleBitmap SetStretchBltMode StretchBlt SetBkMode

user32

IsDlgButtonChecked CheckRadioButton EnumDisplaySettingsW EnumDisplayDevicesW ChangeDisplaySettingsExW GetSysColor CopyImage LoadBitmapW DestroyWindow CreateWindowExW DrawTextW CheckDlgButton MapWindowPoints FillRect RedrawWindow IsCharAlphaNumericW MessageBoxW SystemParametersInfoW SetFocus SetWindowLongW GetParent PostMessageW EnableWindow ShowWindow DialogBoxParamW KillTimer SetTimer EndDialog SetForegroundWindow FindWindowW RegisterClassExW LoadCursorW DefWindowProcW SetWindowTextW SendMessageW EndPaint GetSysColorBrush FrameRect BeginPaint DrawFocusRect GetWindowLongW GetFocus InvalidateRect SetWindowLongPtrW SetDlgItemTextW GetDlgItem GetClientRect MapDialogRect SendDlgItemMessageW SendMessageTimeoutW SetWindowPos PtInRect GetWindowRect GetSystemMetrics GetProcessDefaultLayout ReleaseDC LoadStringW GetDC GetWindowLongPtrW TrackMouseEvent

msvcrt

_wtoi __set_app_type _fmode memcpy __setusermatherr _amsg_exit _initterm memset _unlock __dllonexit _lock _onexit ??1type_info@@UEAA@XZ ?terminate@@YAXXZ _commode _acmdln exit _cexit memcmp _vsnwprintf _purecall free realloc wcschr ??0exception@@QEAA@AEBQEBDH@Z ?what@exception@@UEBAPEBDXZ _ismbblead _exit _XcptFilter __C_specific_handler __getmainargs _callnewh malloc _CxxThrowException ??0exception@@QEAA@AEBV0@@Z ??1exception@@UEAA@XZ

ntdll

WinSqmAddToStream WinSqmIncrementDWORD

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetDeviceInstanceIdW SetupDiGetDeviceInterfaceDetailW SetupDiGetClassDevsW SetupDiOpenDeviceInterfaceW

uxtheme

CloseThemeData GetThemeSysFont GetThemeSysColor GetThemeColor GetThemeFont OpenThemeData IsThemeActive DrawThemeParentBackground

oleacc

CreateStdAccessibleObject LresultFromObject

ole32

CoInitializeSecurity CoUninitialize CoInitializeEx CoSetProxyBlanket StringFromGUID2 CoGetObject CoCreateInstance

oleaut32

SafeArrayGetLBound SysAllocString SysFreeString SafeArrayGetUBound SafeArrayGetElement VariantInit VariantClear

comctl32

PropertySheetW ord381 InitCommonControlsEx

dwrite

DWriteCreateFactory