file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 389KB
Sample230701-lbbehshg2s
SHA256 6784df5a0fca4252a0ec2c34429344d3236c4e9752616143846986e804636777
MD5 127ad697532828a7b9403021034c647b
SHA1 18412ea9a5da6bd84223c064506bb69386802fc8
SHA512 617f23af6435b193bcc0ce9a651a505911cc11e7548a0e2a854a85fc515594ab9fa62ce1d70f0a1bdd792109ee15aee1e6549376e30d8eb7acbaabcd83067b90
SSDEEP 6144:CJpyVYxuYw3qj3zyn8Aa+dX3LH1BW62BmkVi9IZgTTYR:AqEuZ3qj3zq8AtHLVBW6vkVi98I
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 389KB

file.exe

IMPHASH 76f66f6a2d956cb8ef0b973a1556be05
SHA256 6784df5a0fca4252a0ec2c34429344d3236c4e9752616143846986e804636777
MD5 127ad697532828a7b9403021034c647b
SHA1 18412ea9a5da6bd84223c064506bb69386802fc8
SHA512 617f23af6435b193bcc0ce9a651a505911cc11e7548a0e2a854a85fc515594ab9fa62ce1d70f0a1bdd792109ee15aee1e6549376e30d8eb7acbaabcd83067b90
SSDEEP 6144:CJpyVYxuYw3qj3zyn8Aa+dX3LH1BW62BmkVi9IZgTTYR:AqEuZ3qj3zq8AtHLVBW6vkVi98I
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17670

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetLocaleInfoA EnumCalendarInfoA VirtualQuery GetProfileIntW FindResourceExW DeleteVolumeMountPointA ReadConsoleA UnlockFile SetCommBreak GetModuleHandleW GetTickCount FormatMessageA GetCompressedFileSizeW ClearCommBreak GetDateFormatA TlsSetValue GlobalAlloc CopyFileW GetSystemWindowsDirectoryA GetStringTypeExW FindNextVolumeW ReplaceFileW GetVolumePathNameA GetDevicePowerState GetConsoleAliasesW GetLogicalDriveStringsA OpenMutexW GetCurrentDirectoryW SetLastError GetProcAddress GetLongPathNameA BeginUpdateResourceW EnumDateFormatsExA CreateMemoryResourceNotification LoadLibraryA CreateFileMappingA CreateHardLinkW BeginUpdateResourceA SetProcessWorkingSetSize ReadConsoleInputW GetWindowsDirectoryW CloseHandle CreateFileA FlushFileBuffers WriteConsoleW GetConsoleOutputCP WriteConsoleA SetupComm CreateMutexW SetCurrentDirectoryA SetStdHandle InterlockedIncrement InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter MultiByteToWideChar GetLastError HeapFree ExitProcess GetCommandLineA GetStartupInfoA RtlUnwind RaiseException WriteFile GetStdHandle GetModuleFileNameA GetCPInfo GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsFree GetCurrentThreadId TerminateProcess GetCurrentProcess IsDebuggerPresent HeapAlloc HeapCreate VirtualFree VirtualAlloc HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetLocaleInfoA GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW SetFilePointer GetConsoleCP GetConsoleMode

user32

GetClipboardOwner CharToOemBuffA DdeCreateStringHandleA GetMenuBarInfo LoadMenuA CharUpperBuffA DdeQueryStringA

gdi32

GetCharABCWidthsI

advapi32

InitializeAcl

winhttp

WinHttpReadData