file[.]exe | Triage™

General

Target
file.exe
Size 280KB
Sample230804-v793dsdc27
SHA256 03eccfa5dea23fc185bcca277520d7ef473ff752649aac485ac055dd4111b2c1
MD5 789eaea81291addedd12202fac777c8a
SHA1 a790504363ecbc2308e625a6a9fb6b4978a321fd
SHA512 a1a2fcd4025b65dfed3b1e8f05025889a76787ab75c757adc79c714140973634a485a06f421cfebbaa5bf4682b7ab687c38321fd3450ea63164ba4c22318197b
SSDEEP 3072:ZtOpyD58tS/0MmL+JmSxT/fgd3fn8jJaVxmB+AEEb8jRMvw85oicKpSdBqI3:Ey6tG0MmLrSxT/oxaxB+AxHoi/SDn
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 280KB

file.exe

IMPHASH 724ad9571755841c2e0f4aa3cd09706a
SHA256 03eccfa5dea23fc185bcca277520d7ef473ff752649aac485ac055dd4111b2c1
MD5 789eaea81291addedd12202fac777c8a
SHA1 a790504363ecbc2308e625a6a9fb6b4978a321fd
SHA512 a1a2fcd4025b65dfed3b1e8f05025889a76787ab75c757adc79c714140973634a485a06f421cfebbaa5bf4682b7ab687c38321fd3450ea63164ba4c22318197b
SSDEEP 3072:ZtOpyD58tS/0MmL+JmSxT/fgd3fn8jJaVxmB+AEEb8jRMvw85oicKpSdBqI3:Ey6tG0MmLrSxT/oxaxB+AxHoi/SDn
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

32811

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetComputerNameA GetDateFormatW FillConsoleOutputCharacterA HeapReAlloc WritePrivateProfileStructA PeekNamedPipe TlsGetValue GetLocaleInfoA GetStringTypeA GetProfileIntW FindResourceW UpdateResourceA _lwrite InterlockedDecrement FindCloseChangeNotification SetCommBreak ConnectNamedPipe GetTickCount GetConsoleAliasesA CreateActCtxW WriteConsoleOutputA GetNamedPipeInfo GetCompressedFileSizeA DisconnectNamedPipe GetConsoleAliasesW GetLastError GetProcAddress VirtualAlloc CreateMemoryResourceNotification SearchPathA SetFileApisToOEM LoadLibraryA OpenMutexA GetProcessId EnumResourceTypesW GetOEMCP HeapSetInformation CancelTimerQueueTimer Module32Next ReadConsoleInputW GetWindowsDirectoryW ResetWriteWatch WriteConsoleW GetConsoleOutputCP WriteConsoleA InterlockedIncrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection MultiByteToWideChar HeapFree TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW RtlUnwind RaiseException LCMapStringA WideCharToMultiByte LCMapStringW GetCPInfo GetACP IsValidCodePage GetModuleHandleW TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId HeapAlloc HeapCreate VirtualFree ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime HeapSize GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetStringTypeW InitializeCriticalSectionAndSpinCount CloseHandle CreateFileA GetLocaleInfoW GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer SetStdHandle SetEndOfFile GetProcessHeap ReadFile

user32

CharUpperBuffA LoadMenuW CharLowerBuffA CharToOemBuffA

Sharing