file[.]exe | Triage™

General

Target
file.exe
Size 362KB
Sample230712-nfzn1sch74
SHA256 ec0d3113557b7cc0d2d5123ac45922d40e34209fce8cfc2b665cf18cb34b691c
MD5 daf17287aedbfc5b50634b0bdf24b0a5
SHA1 149e392a3dd0d349c5540a03330428935ee5e265
SHA512 2e46ab00e50f2a58cba6da266fe045ebae44bc193d31f5ffef17911a714d1cf21c95b3b732b074c9babe1690e337064b1cd91b85e587c7d486717e3b32f0b65f
SSDEEP 6144:VqLyjLM9QKINikFh0XYUdEiSdNjA7vAqDatrYr+ojsT:EejWQK580oUBSG3DaAU
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 362KB

file.exe

IMPHASH 924121eeb402eb9f1b78bff58e5474f5
SHA256 ec0d3113557b7cc0d2d5123ac45922d40e34209fce8cfc2b665cf18cb34b691c
MD5 daf17287aedbfc5b50634b0bdf24b0a5
SHA1 149e392a3dd0d349c5540a03330428935ee5e265
SHA512 2e46ab00e50f2a58cba6da266fe045ebae44bc193d31f5ffef17911a714d1cf21c95b3b732b074c9babe1690e337064b1cd91b85e587c7d486717e3b32f0b65f
SSDEEP 6144:VqLyjLM9QKINikFh0XYUdEiSdNjA7vAqDatrYr+ojsT:EejWQK580oUBSG3DaAU
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18395

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

EnumCalendarInfoA GetProfileIntW GetSystemWindowsDirectoryW GetComputerNameW CreateHardLinkA LockFile SetTapeParameters GetModuleHandleW GetTickCount GetConsoleAliasesA GetDateFormatA FindResourceExA LoadLibraryW ReadConsoleInputA _hread GetVersionExW EnumSystemCodePagesA FindNextVolumeW GetVolumePathNameA ReplaceFileA DisconnectNamedPipe FlushFileBuffers FindFirstFileA OpenMutexW GetLastError FindResourceA lstrcmpiA GetProcAddress GetLongPathNameA EnumDateFormatsExA CopyFileA LoadLibraryA LocalAlloc SetCurrentDirectoryW BeginUpdateResourceA SetProcessWorkingSetSize HeapWalk SetLocaleInfoW CreateMutexA VirtualProtect GetVersionExA GetWindowsDirectoryW FileTimeToLocalFileTime lstrcpyA CloseHandle CreateFileA GetModuleHandleA WriteConsoleW GetConsoleOutputCP SetLastError CreateMutexW InterlockedIncrement InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter MultiByteToWideChar GetStartupInfoW HeapFree RtlUnwind RaiseException ExitProcess WriteFile GetStdHandle GetModuleFileNameA TerminateProcess GetCurrentProcess IsDebuggerPresent HeapAlloc WideCharToMultiByte SetHandleCount GetFileType GetStartupInfoA TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId HeapSize GetCPInfo GetACP GetOEMCP IsValidCodePage GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc HeapReAlloc GetLocaleInfoA GetStringTypeA GetStringTypeW InitializeCriticalSectionAndSpinCount SetFilePointer GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW SetStdHandle WriteConsoleA

user32

CharUpperBuffW GetMenuBarInfo CharLowerBuffW DdeQueryStringA GetClipboardOwner CharToOemBuffA

advapi32

LogonUserW

Sharing