file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 1007KB
Sample230710-qext5sbe6z
SHA256 2cac970a74cf3c21383ea093fef86dc2628898343935d2eb7be8802a758548ed
MD5 95d643f0fcf157eb2e5040335d18a244
SHA1 0dfdf2a7b7ee9d99531d4b192d50cfc2f04faf16
SHA512 9d11690d5aa598df2ac2ea11a7d09d499a5ec4425307be203bfb9b935e9bca1b4581e9cc76e99717ea71d95cc3b08df3c88dd992ec72b5c325c55893e84085cf
SSDEEP 24576:00cid6dv1xs2VGi/YrhCTYOs6kaXp0rS6txANDr:iv1xs2AxETpkaXp+SugDr
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 1007KB

file.exe

IMPHASH 2e7f2667392d8d1bd01896145ab96743
SHA256 2cac970a74cf3c21383ea093fef86dc2628898343935d2eb7be8802a758548ed
MD5 95d643f0fcf157eb2e5040335d18a244
SHA1 0dfdf2a7b7ee9d99531d4b192d50cfc2f04faf16
SHA512 9d11690d5aa598df2ac2ea11a7d09d499a5ec4425307be203bfb9b935e9bca1b4581e9cc76e99717ea71d95cc3b08df3c88dd992ec72b5c325c55893e84085cf
SSDEEP 24576:00cid6dv1xs2VGi/YrhCTYOs6kaXp0rS6txANDr:iv1xs2AxETpkaXp+SugDr
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

315892

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

gdi32

SetWindowExtEx

comctl32

ord329

kernel32

GetModuleHandleA RaiseException InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW FormatMessageA WideCharToMultiByte MultiByteToWideChar GetStringTypeW InitOnceBeginInitialize InitOnceComplete GetLastError FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW RtlCaptureStackBackTrace IsProcessorFeaturePresent QueryPerformanceCounter QueryPerformanceFrequency SetFileInformationByHandle FlsAlloc FlsGetValue FlsSetValue FlsFree InitOnceExecuteOnce CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime GetTickCount64 CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetModuleHandleW GetProcAddress GetFileInformationByHandleEx CreateSymbolicLinkW CloseHandle WaitForSingleObjectEx Sleep SwitchToThread GetExitCodeThread GetNativeSystemInfo LocalFree EncodePointer DecodePointer LCMapStringEx GetLocaleInfoEx CompareStringEx GetCPInfo InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW GetCurrentProcessId InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcess TerminateProcess CreateFileW RtlUnwind InterlockedPushEntrySList InterlockedFlushSList SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread ResumeThread FreeLibraryAndExitThread GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetCommandLineA GetCommandLineW GetCurrentThread HeapFree SetConsoleCtrlHandler HeapAlloc GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile HeapReAlloc GetTimeZoneInformation OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap ReadConsoleW HeapSize WriteConsoleW

Name

.textbss

Size

Virtual Size

303KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

669KB

Virtual Size

669KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.D11

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

110KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.zdat

Size

155KB

Virtual Size

154KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

270B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ