file[.]exe | Triage™

General

Target
file.exe
Size 321KB
Sample230713-2cg7fsbd87
SHA256 bdd67a2d07debbf8140da392ef933eb53172beae105a4981e7bf8938f393e667
MD5 bd0ac879444d09501ecd26bfb64e115e
SHA1 144faa90681bc3c23928e75b46720f9213435c33
SHA512 8ad99202617f1096678993620cff723d1ff9f1321b3b0ebd4d2614792d2fc04ace4172679bb7c2a90974571c678db7c4bf52b9d48b339e58a1927b02c197dcfc
SSDEEP 6144:hMtLmPa2BkK5VEHMVsNovIXd8WB0hO1b9HEqwlf:kCPa2Bx5usVGovIXd8WbzEq+
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 321KB

file.exe

IMPHASH 0c3d84146fe14348c0e959c10518448a
SHA256 bdd67a2d07debbf8140da392ef933eb53172beae105a4981e7bf8938f393e667
MD5 bd0ac879444d09501ecd26bfb64e115e
SHA1 144faa90681bc3c23928e75b46720f9213435c33
SHA512 8ad99202617f1096678993620cff723d1ff9f1321b3b0ebd4d2614792d2fc04ace4172679bb7c2a90974571c678db7c4bf52b9d48b339e58a1927b02c197dcfc
SSDEEP 6144:hMtLmPa2BkK5VEHMVsNovIXd8WB0hO1b9HEqwlf:kCPa2Bx5usVGovIXd8WbzEq+
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

23218

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetConsoleAliasExesA AllocConsole _llseek lstrcpynA GetConsoleAliasExesLengthA BuildCommDCBAndTimeoutsA DeleteVolumeMountPointA InterlockedIncrement OpenJobObjectA ReadConsoleA WaitNamedPipeA GetNamedPipeHandleStateA HeapFree GetProfileStringW GetComputerNameW BackupSeek _lclose GetModuleHandleW UnlockFileEx FindNextVolumeMountPointA GetConsoleAliasesLengthA GetNumberFormatA GetCompressedFileSizeW GetUserDefaultLangID GetVolumePathNameW GlobalAlloc GetPrivateProfileIntA GetSystemDirectoryW SetFileShortNameW LoadLibraryW ReadConsoleInputA GetVersionExW GetStringTypeExW lstrlenW VirtualUnlock GetShortPathNameA GetCommandLineW GetLastError SetLastError GetProcAddress MoveFileW EnterCriticalSection CreateSemaphoreW OpenWaitableTimerW LocalAlloc GetFileType AddAtomW RemoveDirectoryW FoldStringW GetPrivateProfileSectionNamesA CreateIoCompletionPort _lread FreeEnvironmentStringsW FindNextFileW GetCurrentDirectoryA EnumDateFormatsW FatalAppExitA PeekConsoleInputA SetCalendarInfoA FindFirstVolumeA ReadConsoleInputW TerminateJobObject GetWindowsDirectoryW MoveFileWithProgressW GetConsoleProcessList ReadConsoleOutputCharacterW EnumSystemLocalesW DeleteFileA lstrcpyA FlushFileBuffers CloseHandle CreateFileW EnumSystemLocalesA GetVolumeNameForVolumeMountPointA WriteConsoleW SetStdHandle InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection LeaveCriticalSection EncodePointer DecodePointer MoveFileA WideCharToMultiByte HeapAlloc MultiByteToWideChar HeapReAlloc GetCommandLineA HeapSetInformation GetStartupInfoW RtlUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess GetCPInfo GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId HeapCreate ExitProcess WriteFile GetStdHandle GetModuleFileNameW HeapSize RaiseException GetModuleFileNameA GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetStringTypeW IsProcessorFeaturePresent SetFilePointer GetConsoleCP GetConsoleMode LCMapStringW

user32

CharUpperBuffW GetMessagePos

gdi32

GetCharWidthW

winhttp

WinHttpGetProxyForUrl

Sharing