file[.]exe | Triage™

General

Target
file.exe
Size 313KB
Sample230710-pxbtysbc3z
SHA256 0c5d1c2c1f5bcb910d25419e87349bce28055b67de3ef6bd1e511a6b17290fce
MD5 f4da3bf12c10786ba3cdf5a1eef0d386
SHA1 dc3d6daefead81844e1e6a41eb992d3679239196
SHA512 fc33454cebca070fb0cb7bccc8c8e0511848c246f30e52ef39819e9949a0315e8f5190e7e6916142d202ff4cf5829eb7d6353cf96d9fd4e53f725cd098b050f9
SSDEEP 6144:CAkL3Uvz8l3yh+oAWdCQMt31Nbd7kDmsrO7:9kzOzuyhtCbtldgmk
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 313KB

file.exe

IMPHASH 89580c01d87da774c9ed352344b8ed4a
SHA256 0c5d1c2c1f5bcb910d25419e87349bce28055b67de3ef6bd1e511a6b17290fce
MD5 f4da3bf12c10786ba3cdf5a1eef0d386
SHA1 dc3d6daefead81844e1e6a41eb992d3679239196
SHA512 fc33454cebca070fb0cb7bccc8c8e0511848c246f30e52ef39819e9949a0315e8f5190e7e6916142d202ff4cf5829eb7d6353cf96d9fd4e53f725cd098b050f9
SSDEEP 6144:CAkL3Uvz8l3yh+oAWdCQMt31Nbd7kDmsrO7:9kzOzuyhtCbtldgmk
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18176

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindResourceA SetLocaleInfoA EnumCalendarInfoA GetStringTypeA GetProfileIntW FindResourceExW GetSystemWindowsDirectoryW GetComputerNameW CreateHardLinkA LockFile GetTickCount GetConsoleAliasesA CancelDeviceWakeupRequest GetDateFormatA _hread GetVersionExW Beep VerifyVersionInfoA GetVolumePathNameA ReplaceFileA SetCurrentDirectoryA FindFirstFileA GetLastError SetLastError CreateMutexW GetProcAddress GetLongPathNameA BeginUpdateResourceW EnumDateFormatsExA HeapUnlock CopyFileA EnumSystemCodePagesW LoadLibraryA OpenMutexA LocalAlloc SetProcessWorkingSetSize GetModuleHandleA CreateMutexA VirtualProtect ReadConsoleInputW GetWindowsDirectoryW FileTimeToLocalFileTime FindNextVolumeA lstrcpyA CloseHandle CreateFileA FlushFileBuffers WriteConsoleW lstrcmpiA GetDateFormatW InterlockedIncrement InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection MultiByteToWideChar GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter HeapFree RtlUnwind RaiseException TerminateProcess GetCurrentProcess IsDebuggerPresent HeapAlloc WideCharToMultiByte SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId HeapSize ExitProcess GetCPInfo GetACP GetOEMCP IsValidCodePage WriteFile GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc HeapReAlloc GetLocaleInfoA GetStringTypeW SetFilePointer GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount LCMapStringA LCMapStringW SetStdHandle WriteConsoleA GetConsoleOutputCP

user32

CharUpperBuffW GetMenuBarInfo CharLowerBuffW DdeQueryStringW GetClipboardOwner CharToOemBuffA

advapi32

LogonUserA

Sharing