file[.]exe | Triage™

General

Target
file.exe
Size 239KB
Sample230710-1ercgaef8w
SHA256 303cfe01cf0a8b0815b0e91080e6cb8d3a1b3e8052a969449bd9008decd8fcd4
MD5 c4d2cf79f511e2e32babcc981ddf09af
SHA1 855bf36cc105f26c996fcb1d70f633b9c87a9363
SHA512 7dae1d06a894c5e1b8280bc1334bcc4b1a6e46cb97395413fe0c8e308ff760d1a64157ee74ad43e45900e4822636b5ed2174aaaf85d3450984b2eba790808b63
SSDEEP 3072:JJlU/xLw8P57Hew60fWbvXlQ8NSmK8dCANBoRh5lU4ydDBy53WTwV//i:SxLwSiw60+bvXCSCzAyU4ydD1TM/
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 239KB

file.exe

IMPHASH 5a013624489e6703ae44eba8e360cecd
SHA256 303cfe01cf0a8b0815b0e91080e6cb8d3a1b3e8052a969449bd9008decd8fcd4
MD5 c4d2cf79f511e2e32babcc981ddf09af
SHA1 855bf36cc105f26c996fcb1d70f633b9c87a9363
SHA512 7dae1d06a894c5e1b8280bc1334bcc4b1a6e46cb97395413fe0c8e308ff760d1a64157ee74ad43e45900e4822636b5ed2174aaaf85d3450984b2eba790808b63
SSDEEP 3072:JJlU/xLw8P57Hew60fWbvXlQ8NSmK8dCANBoRh5lU4ydDBy53WTwV//i:SxLwSiw60+bvXCSCzAyU4ydD1TM/
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18171

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindResourceA SetLocaleInfoA EnumCalendarInfoA GetStringTypeA GetProfileIntW GetSystemWindowsDirectoryW GetComputerNameW CreateHardLinkA LockFile GetTickCount GetConsoleAliasesA GetWindowsDirectoryA GetDateFormatA FindResourceExA ReadConsoleInputA _hread GetVersionExW FindNextVolumeW Beep VerifyVersionInfoA GetVolumePathNameA ReplaceFileA FlushFileBuffers SetCurrentDirectoryA CreateMutexW OpenMutexW GetLastError SetLastError lstrcmpiA GetProcAddress GetLongPathNameA BeginUpdateResourceW EnumDateFormatsExA HeapUnlock CopyFileA EnumSystemCodePagesW LoadLibraryA LocalAlloc SetProcessWorkingSetSize GetModuleHandleA CreateMutexA VirtualProtect FileTimeToLocalFileTime lstrcpyA CloseHandle CreateFileA WriteConsoleW GetConsoleOutputCP FindFirstFileA GetDateFormatW InterlockedIncrement InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection MultiByteToWideChar GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter HeapFree RtlUnwind RaiseException TerminateProcess GetCurrentProcess IsDebuggerPresent HeapAlloc WideCharToMultiByte SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId HeapSize ExitProcess GetCPInfo GetACP GetOEMCP IsValidCodePage WriteFile GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc HeapReAlloc GetLocaleInfoA GetStringTypeW SetFilePointer GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount LCMapStringA LCMapStringW SetStdHandle WriteConsoleA

user32

CharUpperBuffW GetMenuBarInfo CharLowerBuffW DdeQueryStringW GetClipboardOwner CharToOemBuffA

advapi32

LogonUserW

Sharing