file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 591KB
Sample230701-k2qfpage76
SHA256 274f5d3d6967d77475ceee848a0dff2cfc9993923861de020e3856bd54ba8fc7
MD5 e83efdb43dc0a53378ccddbd91cb721f
SHA1 4c37dcb21172e28a1933953dfd20d77f58148bab
SHA512 060fc829364932e9452f4a28c81ac13509d807edbe264aceb5ea636230f5aba699308eaab3b9598c5a6b44818c99737752c4327adb97ac5fec71bc664a25f1ae
SSDEEP 12288:Q72WwSPjvuL8XM3lRkRc4YFwjsWAfRgantPbcTTn7axerx7:wwSPr6WM3/kRc4lAgantPbcHn7a
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 591KB

file.exe

IMPHASH 4673ad56625d375f2efee239af061364
SHA256 274f5d3d6967d77475ceee848a0dff2cfc9993923861de020e3856bd54ba8fc7
MD5 e83efdb43dc0a53378ccddbd91cb721f
SHA1 4c37dcb21172e28a1933953dfd20d77f58148bab
SHA512 060fc829364932e9452f4a28c81ac13509d807edbe264aceb5ea636230f5aba699308eaab3b9598c5a6b44818c99737752c4327adb97ac5fec71bc664a25f1ae
SSDEEP 12288:Q72WwSPjvuL8XM3lRkRc4YFwjsWAfRgantPbcTTn7axerx7:wwSPr6WM3/kRc4lAgantPbcHn7a
MD5 SHA1 SHA512 SSDEEP

windows x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

115676

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW RegCreateKeyExW CloseTrace GetTraceLoggerHandle GetTraceEnableLevel GetTraceEnableFlags RegisterTraceGuidsW UnregisterTraceGuids RegCloseKey OpenProcessToken TraceMessage DuplicateToken ControlTraceW StartTraceW EnableTrace CheckTokenMembership GetTokenInformation RegOpenKeyExW CreateWellKnownSid RegQueryValueExW

kernel32

GetLocaleInfoW FormatMessageW FreeLibrary GetProcAddress LoadLibraryW Sleep GetLocalTime GetCalendarInfoW QueryPerformanceCounter GetModuleHandleW SetUnhandledExceptionFilter GetStartupInfoW CreateThread GetDriveTypeW GetVolumeInformationW InitializeSListHead RtlCaptureStackBackTrace InterlockedPushEntrySList InterlockedPopEntrySList FileTimeToSystemTime SystemTimeToFileTime LeaveCriticalSection EnterCriticalSection CloseHandle SetEvent DeleteCriticalSection InitializeCriticalSection GetVolumeNameForVolumeMountPointW GetTimeFormatW GetDateFormatW SetLastError WaitForSingleObject CreateEventW GetCurrentProcess SetErrorMode GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess GetTickCount UnhandledExceptionFilter FindFirstFileW FindNextFileW GetProcessHeap HeapSetInformation RegisterApplicationRestart GetCommandLineW LocalFree GetLastError CreateDirectoryW DeleteFileW GetFileAttributesW FindClose CreateFileW DeviceIoControl MoveFileExW LoadLibraryExW GetVolumePathNameW ExpandEnvironmentStringsW

gdi32

DeleteDC GdiFlush SelectObject SetLayout CreateCompatibleDC CreateDIBSection SetTextColor ExtTextOutW CreateFontIndirectW DeleteObject GetDeviceCaps SetBkColor

user32

LoadStringW IsDlgButtonChecked GetDlgItemTextW SetDlgItemTextW CheckDlgButton DrawFrameControl OffsetRect SetTimer KillTimer GetSysColorBrush GetWindowLongPtrW DestroyWindow EnableWindow EndDialog SetWindowLongPtrW EndPaint GetSysColor MapWindowPoints BeginPaint ShowWindow PostMessageW SetWindowPos LoadImageW GetDesktopWindow SetFocus SetWindowLongW GetWindowLongW GetDlgItem DestroyIcon MoveWindow GetWindowRect GetClientRect ClientToScreen GetSystemMetrics SendMessageW DialogBoxParamW SetForegroundWindow GetDC SetWindowTextW ReleaseDC SystemParametersInfoW SendMessageTimeoutW GetWindowTextW EnumWindows MessageBoxW ChangeWindowMessageFilter RegisterWindowMessageW InflateRect

msvcrt

_vscwprintf iswspace memcpy memset ?terminate@@YAXXZ __set_app_type _fmode _commode __setusermatherr _amsg_exit _initterm _acmdln exit _cexit _exit _XcptFilter __C_specific_handler __getmainargs _purecall ??2@YAPEAX_K@Z _wtol memmove wcstok _wcsicmp ??3@YAXPEAX@Z _ismbblead wcschr _vsnwprintf

shell32

CommandLineToArgvW ShellExecuteExW SHGetFileInfoW SHGetStockIconInfo

ole32

CoUninitialize CoTaskMemFree CoTaskMemAlloc CoDisconnectObject CoCreateInstance CoInitializeEx CoInitializeSecurity

oleaut32

SysStringLen VariantClear VariantInit VariantTimeToSystemTime SysFreeString SysAllocString SystemTimeToVariantTime

comctl32

ImageList_AddMasked ImageList_Add ImageList_ReplaceIcon ImageList_Destroy ImageList_Create ord345 InitCommonControlsEx ord344

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind WinSqmAddToStream RtlAllocateHeap RtlFreeHeap RtlGetLastNtStatus EtwTraceMessage

virtdisk

GetStorageDependencyInformation

sxshared

SxTracerDebuggerBreak SxTracerShouldTrackFailure SxTracerGetThreadContextRetail