file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 387KB
Sample230630-2ydfdsfa24
SHA256 105b4d12c4e131b71a04802d0874f8095f90c7ca76eac54d47e4061da6cbabd0
MD5 89ebbc1da20269159e8eedc03642fdfa
SHA1 514e3364773ac6bd3a534b4074e0fe72c62eb781
SHA512 2d3163fbcc0dd0be2a61c6b1c137d7698d339d7820dc250e36c0c2e242e9029c4ea555fc04e0cef15ea7c768cb769f316cac3d4cc2f1ee9260eceda902ec1753
SSDEEP 6144:JSBC8yNeIL1AYhXFMyw3oajYINc0Qm34naWzyT:JS88Ja1AbHjYIa0Qm3QaWzC
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 387KB

file.exe

IMPHASH e01beb805c20903e324ef65e741d0209
SHA256 105b4d12c4e131b71a04802d0874f8095f90c7ca76eac54d47e4061da6cbabd0
MD5 89ebbc1da20269159e8eedc03642fdfa
SHA1 514e3364773ac6bd3a534b4074e0fe72c62eb781
SHA512 2d3163fbcc0dd0be2a61c6b1c137d7698d339d7820dc250e36c0c2e242e9029c4ea555fc04e0cef15ea7c768cb769f316cac3d4cc2f1ee9260eceda902ec1753
SSDEEP 6144:JSBC8yNeIL1AYhXFMyw3oajYINc0Qm34naWzyT:JS88Ja1AbHjYIa0Qm3QaWzC
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17055

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

EnumCalendarInfoA EnumDateFormatsExW VirtualQuery GetProfileIntW FindResourceExW DeleteVolumeMountPointA ReadConsoleA UnlockFile SetCommBreak GetModuleHandleW GetTickCount EscapeCommFunction FormatMessageA GetCompressedFileSizeW ClearCommBreak GetDateFormatA TlsSetValue CopyFileW GetSystemWindowsDirectoryA GetStringTypeExW FindNextVolumeW ReplaceFileW GetVolumePathNameA GetDevicePowerState ReleaseSemaphore SetLocaleInfoA SetCurrentDirectoryA GetLogicalDriveStringsA OpenMutexW GetCurrentDirectoryW SetLastError GetProcAddress GetLongPathNameA BeginUpdateResourceW CreateMemoryResourceNotification LoadLibraryA CreateHardLinkW BeginUpdateResourceA SetProcessWorkingSetSize OpenSemaphoreW ReadConsoleInputW GetWindowsDirectoryW CreateFileA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA CloseHandle SetFilePointer CreateMutexW GetConsoleAliasesW FlushFileBuffers GetConsoleMode InterlockedIncrement InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLastError HeapFree UnhandledExceptionFilter SetUnhandledExceptionFilter MultiByteToWideChar ExitProcess GetCommandLineA GetStartupInfoA RtlUnwind RaiseException HeapAlloc HeapCreate VirtualFree VirtualAlloc HeapReAlloc TerminateProcess GetCurrentProcess IsDebuggerPresent WriteFile GetStdHandle GetModuleFileNameA GetCPInfo GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsFree GetCurrentThreadId InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime HeapSize GetLocaleInfoA GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW GetConsoleCP

user32

SetCaretPos CharToOemBuffA DdeCreateStringHandleA GetMenuBarInfo LoadMenuA CharUpperBuffA GetSysColorBrush DdeQueryStringA

gdi32

GetCharABCWidthsI

advapi32

InitializeAcl

winhttp

WinHttpReadData