file[.]exe | Triage™

General

Target
file.exe
Size 455KB
Sample230807-e1dslseg5s
SHA256 096ce9d0b724b551b98d226fdf21dfaa731606e0d2cfd8f259fe09db24e6e15d
MD5 bb6c836b90e6245646e07af2ec225e27
SHA1 5df975600d2b335f97c11933314d4db3ae2663fe
SHA512 17f7043803271e9653e648b30e17da2439f348807b10ebed0058d09b02a95ac25d6dcf6f98be71caee3eaa084f80faa403effc4e1199ff3a70268352186966bc
SSDEEP 6144:uNxKQJDbq2GFPyYg/tCfZu6HjuD6vK8oDD+YzBj7XU:0wQVb7GlyYqtMZXiD6iDfbd7XU
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 455KB

file.exe

IMPHASH f6429983d70ccd6d64f4cf8f0424f062
SHA256 096ce9d0b724b551b98d226fdf21dfaa731606e0d2cfd8f259fe09db24e6e15d
MD5 bb6c836b90e6245646e07af2ec225e27
SHA1 5df975600d2b335f97c11933314d4db3ae2663fe
SHA512 17f7043803271e9653e648b30e17da2439f348807b10ebed0058d09b02a95ac25d6dcf6f98be71caee3eaa084f80faa403effc4e1199ff3a70268352186966bc
SSDEEP 6144:uNxKQJDbq2GFPyYg/tCfZu6HjuD6vK8oDD+YzBj7XU:0wQVb7GlyYqtMZXiD6iDfbd7XU
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

33331

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

_llseek DeleteVolumeMountPointA InterlockedIncrement MoveFileExW GetConsoleAliasA GetSystemWindowsDirectoryW GetUserDefaultLCID FlushConsoleInputBuffer GetModuleHandleW GetTickCount GenerateConsoleCtrlEvent GetConsoleAliasExesW WaitNamedPipeW GetDateFormatA EnumTimeFormatsW GetUserDefaultLangID GetDriveTypeA GlobalAlloc GetSystemDirectoryW SetFileShortNameW LoadLibraryW GetConsoleMode TerminateThread ReadConsoleInputA _hread GetCalendarInfoA GetConsoleAliasExesLengthW GetTimeFormatW GetFileAttributesW TerminateProcess QueryInformationJobObject GetOverlappedResult GetStartupInfoW CreateMailslotW GetPrivateProfileIntW InterlockedExchange CreateMutexW OpenMutexW GetHandleInformation GetLastError GetCurrentDirectoryW SetLastError GetProcAddress PeekConsoleInputW MoveFileW GlobalGetAtomNameA OpenWaitableTimerA InterlockedExchangeAdd GetFileType BuildCommDCBAndTimeoutsW GetNumberFormatW AddAtomW SetCurrentDirectoryW GetProfileStringA OpenJobObjectW GetModuleHandleA FreeEnvironmentStringsW FindNextFileW EnumDateFormatsW QueryPerformanceFrequency OpenSemaphoreW LocalSize GetWindowsDirectoryW FindFirstVolumeW GetVolumeNameForVolumeMountPointW MoveFileWithProgressW DebugBreak ResetWriteWatch ReadConsoleOutputCharacterW EnumSystemLocalesW DeleteFileA GetComputerNameA SetProcessAffinityMask GetStartupInfoA GetCommandLineW InterlockedDecrement EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection MoveFileA HeapFree HeapAlloc GetCommandLineA HeapSetInformation RaiseException RtlUnwind WideCharToMultiByte LCMapStringW MultiByteToWideChar GetCPInfo IsProcessorFeaturePresent HeapCreate ExitProcess WriteFile GetStdHandle GetModuleFileNameW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentProcess SetFilePointer GetModuleFileNameA GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetLocaleInfoW HeapSize GetACP GetOEMCP IsValidCodePage GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeW HeapReAlloc SetStdHandle GetConsoleCP FlushFileBuffers WriteConsoleW CreateFileW CloseHandle

gdi32

GetTextFaceA

advapi32

InitializeAcl

Sharing