file[.]exe | Triage™

General

Target
file.exe
Size 321KB
Sample230710-rey8msba55
SHA256 ca3c6a4c08e5fab0105dc5ac39ebfa918be5ad7a2a75d89792e857597b609952
MD5 508bbdd63475923790bea3020e5f701b
SHA1 559bf51e0e22583f0da9f117f95f3122ba72a532
SHA512 ac45acb02b7f914fbf0c65459eac1cd96563fcf4bbe130edc75a6cb1417e6ae254198523dddb5e9b308e75186b0e8fd1545542a6c13502aeded45d4c9dbc7c70
SSDEEP 6144:SOfLDZ+jO+B4nqAchV3CVWWUvYgDAmdRKekT:lf/ZvQ4PchV3CAWUwwn6
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 321KB

file.exe

IMPHASH 89580c01d87da774c9ed352344b8ed4a
SHA256 ca3c6a4c08e5fab0105dc5ac39ebfa918be5ad7a2a75d89792e857597b609952
MD5 508bbdd63475923790bea3020e5f701b
SHA1 559bf51e0e22583f0da9f117f95f3122ba72a532
SHA512 ac45acb02b7f914fbf0c65459eac1cd96563fcf4bbe130edc75a6cb1417e6ae254198523dddb5e9b308e75186b0e8fd1545542a6c13502aeded45d4c9dbc7c70
SSDEEP 6144:SOfLDZ+jO+B4nqAchV3CVWWUvYgDAmdRKekT:lf/ZvQ4PchV3CAWUwwn6
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18176

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindResourceA SetLocaleInfoA EnumCalendarInfoA GetStringTypeA GetProfileIntW FindResourceExW GetSystemWindowsDirectoryW GetComputerNameW CreateHardLinkA LockFile GetTickCount GetConsoleAliasesA CancelDeviceWakeupRequest GetDateFormatA _hread GetVersionExW Beep VerifyVersionInfoA GetVolumePathNameA ReplaceFileA SetCurrentDirectoryA FindFirstFileA GetLastError SetLastError CreateMutexW GetProcAddress GetLongPathNameA BeginUpdateResourceW EnumDateFormatsExA HeapUnlock CopyFileA EnumSystemCodePagesW LoadLibraryA OpenMutexA LocalAlloc SetProcessWorkingSetSize GetModuleHandleA CreateMutexA VirtualProtect ReadConsoleInputW GetWindowsDirectoryW FileTimeToLocalFileTime FindNextVolumeA lstrcpyA CloseHandle CreateFileA FlushFileBuffers WriteConsoleW lstrcmpiA GetDateFormatW InterlockedIncrement InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection MultiByteToWideChar GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter HeapFree RtlUnwind RaiseException TerminateProcess GetCurrentProcess IsDebuggerPresent HeapAlloc WideCharToMultiByte SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId HeapSize ExitProcess GetCPInfo GetACP GetOEMCP IsValidCodePage WriteFile GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc HeapReAlloc GetLocaleInfoA GetStringTypeW SetFilePointer GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount LCMapStringA LCMapStringW SetStdHandle WriteConsoleA GetConsoleOutputCP

user32

CharUpperBuffW GetMenuBarInfo CharLowerBuffW DdeQueryStringW GetClipboardOwner CharToOemBuffA

advapi32

LogonUserA

Sharing