file[.]exe | Triage™

General

Target
file.exe
Size 270KB
Sample230714-dtln7sca39
SHA256 7e332993bb155e096895d26b3a6f86e950bb4909d32ef450dd6e45726de5e7e6
MD5 331e213bea057e7fcf143f8d5c56756d
SHA1 a6187ddd4b93480323394cdc1af6e00b2afee1ee
SHA512 5c6ec88ba0805595bf3788a9553804f42f72ba4786bedc181f1aecd8282912d3f63bf65e4020b00ef49a3ada5c0f41a945a77a9e2683d05a548612e7692bc60f
SSDEEP 6144:PLOWjBuatnipNv9NxNK+MUVmZkLKPla9MhJF:PVjXlE/K+vVmamT5
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 270KB

file.exe

IMPHASH 3129b82d0a2746cb6ab1a7613afd0e3c
SHA256 7e332993bb155e096895d26b3a6f86e950bb4909d32ef450dd6e45726de5e7e6
MD5 331e213bea057e7fcf143f8d5c56756d
SHA1 a6187ddd4b93480323394cdc1af6e00b2afee1ee
SHA512 5c6ec88ba0805595bf3788a9553804f42f72ba4786bedc181f1aecd8282912d3f63bf65e4020b00ef49a3ada5c0f41a945a77a9e2683d05a548612e7692bc60f
SSDEEP 6144:PLOWjBuatnipNv9NxNK+MUVmZkLKPla9MhJF:PVjXlE/K+vVmamT5
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18398

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindResourceA EnumCalendarInfoA EnumDateFormatsExW FindResourceW CreateHardLinkA SetTapeParameters GetModuleHandleW GetTickCount GetConsoleAliasesA GetWindowsDirectoryA GetVolumePathNameW GlobalAlloc LoadLibraryW ReadConsoleInputA CopyFileW EnumSystemCodePagesA DisconnectNamedPipe FlushFileBuffers GetProfileIntA SetCurrentDirectoryA GetLastError CreateMutexW GetProcAddress BeginUpdateResourceW LoadLibraryA OpenMutexA lstrcmpiW SetLocaleInfoW CreateMutexA VirtualProtect GetVersionExA FileTimeToLocalFileTime lstrcpyA CreateFileA CloseHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetModuleHandleA SetLastError GetComputerNameA InterlockedIncrement InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter MultiByteToWideChar ExitProcess GetStartupInfoW HeapFree RtlUnwind RaiseException WriteFile GetStdHandle GetModuleFileNameA HeapAlloc SetHandleCount GetFileType GetStartupInfoA TerminateProcess GetCurrentProcess IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId HeapSize GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc HeapReAlloc GetLocaleInfoA GetStringTypeA GetStringTypeW SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW

user32

CharToOemBuffA RealGetWindowClassW CharUpperBuffW GetMenuBarInfo CharUpperA CharLowerBuffW CharUpperBuffA LoadMenuW DdeQueryStringA GetClipboardOwner

advapi32

LogonUserW

Sharing