file[.]exe | Triage™

General

Target
file.exe
Size 278KB
Sample230629-qf3f1sdb22
SHA256 e7d7c5a24455d0de7fdf25c4ccf0cfbba819057fbcdcdfb478a08da84abffa49
MD5 86b471b9496dab0c4c7a890b2f80e0c7
SHA1 71601f81dc0e87eeaf2cd9640607e62ecc5653da
SHA512 4a526712756bafd8a27895b316ffd8904b798e1d255cb272420bca8f7d41848b4f15949ace256d68345dba4c61f35238498abb6fe1f13d02d0f8b6ea551c71e5
SSDEEP 3072:Hi3UpCtlfpq7HmTfcYV761zX+uW5CTsnFuLArYD3U9OV4:CEmW7HmT0eqDnmmsFu3m
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 278KB

file.exe

IMPHASH 4ef5c5864141626e44cf96ed52dc90ca
SHA256 e7d7c5a24455d0de7fdf25c4ccf0cfbba819057fbcdcdfb478a08da84abffa49
MD5 86b471b9496dab0c4c7a890b2f80e0c7
SHA1 71601f81dc0e87eeaf2cd9640607e62ecc5653da
SHA512 4a526712756bafd8a27895b316ffd8904b798e1d255cb272420bca8f7d41848b4f15949ace256d68345dba4c61f35238498abb6fe1f13d02d0f8b6ea551c71e5
SSDEEP 3072:Hi3UpCtlfpq7HmTfcYV761zX+uW5CTsnFuLArYD3U9OV4:CEmW7HmT0eqDnmmsFu3m
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27283

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

AllocConsole ConvertThreadToFiber GetConsoleAliasExesLengthA InterlockedIncrement OpenJobObjectA InterlockedDecrement WriteConsoleInputA FreeEnvironmentStringsA GetModuleHandleW GetTickCount GetCurrentThread GetWindowsDirectoryA WaitNamedPipeW EnumTimeFormatsA GetCommandLineA GetPriorityClass GetVolumePathNameW SetFileShortNameW GetCalendarInfoA LeaveCriticalSection CreateSemaphoreA GetFileAttributesW WriteConsoleW GetCompressedFileSizeA CompareStringW GetVolumePathNameA SetThreadPriority CreateMailslotW GetCPInfoExW GetCurrentDirectoryW SetLastError GetProcAddress GetConsoleAliasesLengthW SearchPathA GlobalFree GetTempFileNameA OpenWaitableTimerA LoadLibraryA InterlockedExchangeAdd LocalAlloc SetCalendarInfoW MoveFileA GetNumberFormatW BeginUpdateResourceA VirtualLock AddAtomA HeapWalk OpenJobObjectW GetPrivateProfileSectionNamesA FindNextFileA EnumDateFormatsA GetModuleHandleA GetStringTypeW GetCurrentDirectoryA GetShortPathNameW GetCPInfoExA GetVolumeNameForVolumeMountPointW GetFileInformationByHandle DebugBreak ReadConsoleOutputCharacterW OpenFileMappingA LocalFileTimeToFileTime ReadFile HeapReAlloc CreateMutexW MoveFileW Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection EncodePointer DecodePointer GetLastError WideCharToMultiByte MultiByteToWideChar HeapSetInformation GetStartupInfoW RaiseException HeapFree RtlUnwind HeapAlloc IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess GetCPInfo GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId SetFilePointer CloseHandle ExitProcess WriteFile GetStdHandle GetModuleFileNameW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType HeapCreate QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime HeapSize LCMapStringW SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers LoadLibraryW CreateFileW

user32

GetAltTabInfoW

advapi32

ReadEventLogW

Sharing