file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 288KB
Sample230721-sb53fsff2w
SHA256 a6fc4a38eba09a4fd88f8ef483a908f19a03190ead4cb4e04fe223fab02b8a7d
MD5 4142eaff997e130d4d92722fe8828e41
SHA1 40d7b1408b39e2028a59257a72d49876a555c88a
SHA512 99ef96e397015df7e0c036063a20a43b81873546fbb009513fd0912cdc32bf94836733bb188abdef573c9a79d0198df0be229bb68690ab9e423414c8b003317b
SSDEEP 6144:x7u5DOxzF2L8ZlQk1tUeJpj/43M8Rangu2+UvQ/KpmOq:x72SxzF2LilQkL/4cEKMvQ/Kp
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 288KB

file.exe

IMPHASH 287240fab1f223abb090ff96769db3f7
SHA256 a6fc4a38eba09a4fd88f8ef483a908f19a03190ead4cb4e04fe223fab02b8a7d
MD5 4142eaff997e130d4d92722fe8828e41
SHA1 40d7b1408b39e2028a59257a72d49876a555c88a
SHA512 99ef96e397015df7e0c036063a20a43b81873546fbb009513fd0912cdc32bf94836733bb188abdef573c9a79d0198df0be229bb68690ab9e423414c8b003317b
SSDEEP 6144:x7u5DOxzF2L8ZlQk1tUeJpj/43M8Rangu2+UvQ/KpmOq:x72SxzF2LilQkL/4cEKMvQ/Kp
MD5 SHA1 SHA512 SSDEEP

windows x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

172160

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

TraceMessage GetTraceLoggerHandle GetTraceEnableLevel GetTraceEnableFlags RegisterTraceGuidsW UnregisterTraceGuids ConvertStringSecurityDescriptorToSecurityDescriptorW RegOpenKeyExW CloseTrace InitiateShutdownW OpenSCManagerW OpenServiceW ControlService OpenProcessToken RegCloseKey CloseServiceHandle CreateWellKnownSid CheckTokenMembership LookupPrivilegeValueW AdjustTokenPrivileges StartTraceW EnableTrace GetTokenInformation RegQueryValueExW RegQueryInfoKeyW InitializeSecurityDescriptor SetEntriesInAclW SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl DuplicateToken DuplicateTokenEx RegisterEventSourceW ReportEventW DeregisterEventSource ControlTraceW

kernel32

FileTimeToLocalFileTime GetTimeFormatW GetDateFormatW GetUserDefaultLCID GetLocaleInfoW FindVolumeClose FindNextVolumeW FindFirstVolumeW GetWindowsDirectoryW GetVolumeNameForVolumeMountPointW GetVolumePathNameW GetVolumePathNamesForVolumeNameW ExpandEnvironmentStringsW GetVolumeInformationW GetDriveTypeW MoveFileExW DeviceIoControl FileTimeToSystemTime FindNextFileW FindFirstFileW FormatMessageW UnhandledExceptionFilter TerminateProcess GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter GetModuleHandleW SetUnhandledExceptionFilter GetStartupInfoW Sleep InitializeCriticalSection CreateFileW EncodePointer DecodePointer GetProcAddress DeleteCriticalSection SetLastError HeapSetInformation SetErrorMode CreateEventW WaitForSingleObject SetEvent RegisterApplicationRestart GetCurrentProcess GlobalFree GetCommandLineW CreateProcessW CreateThread OpenProcess GetSystemTimeAsFileTime LoadLibraryW FreeLibrary GetFileAttributesW DeleteFileW CreateDirectoryW SetThreadPreferredUILanguages GetTimeZoneInformation LoadLibraryExW InitializeCriticalSectionAndSpinCount EnterCriticalSection LeaveCriticalSection FindClose GetLastError LocalFree CloseHandle

gdi32

SetBkMode DeleteDC GdiFlush SelectObject SetLayout CreateCompatibleDC ExtTextOutW SetBkColor CreateDIBSection GetDeviceCaps CreateFontIndirectW SetTextColor DeleteObject

user32

GetDesktopWindow GetWindowThreadProcessId EnumWindows MessageBoxW SendMessageTimeoutW EndPaint MapWindowPoints CopyRect GetWindowTextW GetWindowRect BeginPaint GetAncestor GetClassNameW GetDlgItemTextW SetDlgItemTextW MsgWaitForMultipleObjectsEx DispatchMessageW PeekMessageW LoadStringW SystemParametersInfoW LoadIconW SetForegroundWindow CreateDialogParamW ShowWindow DestroyWindow DialogBoxParamW RegisterWindowMessageW GetDC ReleaseDC SetWindowLongPtrW PostMessageW GetParent GetDlgItem GetSystemMetrics GetSysColor SetWindowPos GetSysColorBrush EndDialog SetFocus GetKeyState SetWindowLongW GetWindowLongW UpdateWindow GetClientRect SetWindowTextW SetClassLongPtrW GetWindowLongPtrW IsWindow CallWindowProcW SendMessageW EnableWindow DrawFrameControl OffsetRect InflateRect

msvcrt

wcschr _wcsnicmp _wcsicmp ??2@YAPEAX_K@Z __getmainargs __C_specific_handler _XcptFilter _exit _ismbblead _cexit exit _acmdln _initterm ??3@YAXPEAX@Z __setusermatherr _commode _fmode __set_app_type _unlock __dllonexit _lock _onexit ?terminate@@YAXXZ memset memcmp iswspace _amsg_exit _vscwprintf memcpy _vsnwprintf strchr memmove

shell32

ShellExecuteExW SHGetStockIconInfo CommandLineToArgvW

ole32

CoCreateInstance CoTaskMemAlloc CLSIDFromString CoInitializeSecurity CoTaskMemRealloc CoInitializeEx CoTaskMemFree CoUninitialize

oleaut32

SysFreeString SysAllocString SysStringLen

comctl32

CreatePropertySheetPageW PropertySheetW DestroyPropertySheetPage ord345 InitCommonControlsEx ImageList_Create ImageList_Add ImageList_AddMasked ImageList_Destroy ord344

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlLookupElementGenericTableAvl RtlInsertElementGenericTableAvl RtlInitializeGenericTableAvl RtlEnumerateGenericTableAvl RtlDeleteElementGenericTableAvl WinSqmAddToStreamEx WinSqmIncrementDWORD WinSqmAddToStream NtShutdownSystem RtlGetLastNtStatus RtlVirtualUnwind EtwTraceMessage RtlNtStatusToDosError

srcore

SrFreeRpPropArray SrFreeRestoreStatus

spp

SxTracerDebuggerBreak SxTracerShouldTrackFailure SxTracerGetThreadContextRetail SppFreeExternalGroupPropArray