file[.]exe | Triage™

General

Target
file.exe
Size 383KB
Sample230807-ep7xbaef6x
SHA256 9b400556890eb898227a06f91838ff0edf22c19a5f06d5f99181c7da2c45ea07
MD5 0895ce27dc1c490a255f9e482c2860c4
SHA1 7b3e1719976430ef35e9a87cc1f3d25d1f204402
SHA512 dc86637193282fa1af783b645f50537ea26a8b46099feb1b4399d994d5ecaa7ccd3688919482e7a11ed2dff0b3fb4e9435ec2512f62b68f437fa0f29b357f187
SSDEEP 6144:WNosHpxrgdQCehYroroFzWxv7OP8DHLYv:MoSp5gi4ro8cPDHU
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 383KB

file.exe

IMPHASH f6429983d70ccd6d64f4cf8f0424f062
SHA256 9b400556890eb898227a06f91838ff0edf22c19a5f06d5f99181c7da2c45ea07
MD5 0895ce27dc1c490a255f9e482c2860c4
SHA1 7b3e1719976430ef35e9a87cc1f3d25d1f204402
SHA512 dc86637193282fa1af783b645f50537ea26a8b46099feb1b4399d994d5ecaa7ccd3688919482e7a11ed2dff0b3fb4e9435ec2512f62b68f437fa0f29b357f187
SSDEEP 6144:WNosHpxrgdQCehYroroFzWxv7OP8DHLYv:MoSp5gi4ro8cPDHU
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

33315

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

_llseek DeleteVolumeMountPointA InterlockedIncrement MoveFileExW GetConsoleAliasA GetSystemWindowsDirectoryW GetUserDefaultLCID FlushConsoleInputBuffer GetModuleHandleW GetTickCount GenerateConsoleCtrlEvent GetConsoleAliasExesW WaitNamedPipeW GetDateFormatA EnumTimeFormatsW GetUserDefaultLangID GetDriveTypeA GlobalAlloc GetSystemDirectoryW SetFileShortNameW LoadLibraryW GetConsoleMode TerminateThread ReadConsoleInputA _hread GetCalendarInfoA GetConsoleAliasExesLengthW GetTimeFormatW GetFileAttributesW TerminateProcess QueryInformationJobObject GetOverlappedResult GetStartupInfoW CreateMailslotW GetPrivateProfileIntW InterlockedExchange CreateMutexW OpenMutexW GetHandleInformation GetLastError GetCurrentDirectoryW SetLastError GetProcAddress PeekConsoleInputW MoveFileW GlobalGetAtomNameA OpenWaitableTimerA InterlockedExchangeAdd GetFileType BuildCommDCBAndTimeoutsW GetNumberFormatW AddAtomW SetCurrentDirectoryW GetProfileStringA OpenJobObjectW GetModuleHandleA FreeEnvironmentStringsW FindNextFileW EnumDateFormatsW QueryPerformanceFrequency OpenSemaphoreW LocalSize GetWindowsDirectoryW FindFirstVolumeW GetVolumeNameForVolumeMountPointW MoveFileWithProgressW DebugBreak ResetWriteWatch ReadConsoleOutputCharacterW EnumSystemLocalesW DeleteFileA GetComputerNameA SetProcessAffinityMask GetStartupInfoA GetCommandLineW InterlockedDecrement EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection MoveFileA HeapFree HeapAlloc GetCommandLineA HeapSetInformation RaiseException RtlUnwind WideCharToMultiByte LCMapStringW MultiByteToWideChar GetCPInfo IsProcessorFeaturePresent HeapCreate ExitProcess WriteFile GetStdHandle GetModuleFileNameW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentProcess SetFilePointer GetModuleFileNameA GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetLocaleInfoW HeapSize GetACP GetOEMCP IsValidCodePage GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeW HeapReAlloc SetStdHandle GetConsoleCP FlushFileBuffers WriteConsoleW CreateFileW CloseHandle

gdi32

GetTextFaceA

advapi32

InitializeAcl

Sharing