file[.]exe | Triage™

General

Target
file.exe
Size 345KB
Sample230720-aebc5scd21
SHA256 d3b95985bbdac941180a93d4e2ce29a9fae660f79b2f740eea472d306cb2a062
MD5 a1d80795d69bcf1e78b62ae3b0ed4bc6
SHA1 e42098543a886087d33e68bbd95bf103a95ea656
SHA512 d7c1825dad47d73e2dba0529f7398a7128c31f98e41758ed22919719472830661d27da0de079685079fcb810809b618f9a713055dc7361902a05a3a8d8c600c1
SSDEEP 6144:fmpQEO0H0QR38D7hJbTsxGjHrRhH5zqxrEiw0dF:XEOHMMDFJfdjRSM0
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 345KB

file.exe

IMPHASH 02f23a44e70611470e4c2107da6d7f64
SHA256 d3b95985bbdac941180a93d4e2ce29a9fae660f79b2f740eea472d306cb2a062
MD5 a1d80795d69bcf1e78b62ae3b0ed4bc6
SHA1 e42098543a886087d33e68bbd95bf103a95ea656
SHA512 d7c1825dad47d73e2dba0529f7398a7128c31f98e41758ed22919719472830661d27da0de079685079fcb810809b618f9a713055dc7361902a05a3a8d8c600c1
SSDEEP 6144:fmpQEO0H0QR38D7hJbTsxGjHrRhH5zqxrEiw0dF:XEOHMMDFJfdjRSM0
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21379

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedIncrement OpenSemaphoreA BackupSeek FreeEnvironmentStringsA _lclose GetModuleHandleW GetConsoleAliasesLengthA GetNumberFormatA GetConsoleAliasExesW WaitNamedPipeW GetCommandLineA GetVolumePathNameW GlobalAlloc SetFileShortNameW LoadLibraryW FatalAppExitW GetPrivateProfileStructW GetVersionExW DeleteVolumeMountPointW SetConsoleCursorPosition TerminateProcess GetCompressedFileSizeA GetOverlappedResult GetShortPathNameA GetNamedPipeHandleStateW GetPrivateProfileIntW GetLastError GetConsoleAliasExesLengthA ReadConsoleOutputCharacterA GetProcAddress HeapSize MoveFileW RemoveDirectoryA SetStdHandle OpenWaitableTimerW LocalAlloc BuildCommDCBAndTimeoutsW FindFirstVolumeMountPointW GetProfileStringA FoldStringA FindNextFileA EnumDateFormatsA _lread CreateMailslotA GetStringTypeW GetCurrentDirectoryA PeekConsoleInputA DeleteCriticalSection SetCalendarInfoA ReadConsoleInputW GetWindowsDirectoryW FindFirstVolumeW GetConsoleProcessList CloseHandle CreateFileW ReadFile _llseek GetFileSize AllocConsole SetLastError GetPrivateProfileSectionNamesW InterlockedDecrement Sleep InitializeCriticalSection EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer MoveFileA WideCharToMultiByte HeapFree HeapAlloc ExitProcess MultiByteToWideChar HeapReAlloc HeapSetInformation GetStartupInfoW RtlUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentProcess GetCPInfo GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId HeapCreate WriteFile GetStdHandle GetModuleFileNameW InitializeCriticalSectionAndSpinCount RaiseException GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime IsProcessorFeaturePresent SetFilePointer GetConsoleCP GetConsoleMode LCMapStringW WriteConsoleW FlushFileBuffers DeleteFileA

user32

CharUpperW CharUpperBuffW

gdi32

GetCharWidthA GetCharWidthFloatW

advapi32

ReadEventLogA

Sharing