file[.]exe | Triage™

General

Target
file.exe
Size 266KB
Sample230822-vahxmsdf92
SHA256 ee63da071d702cc7795ae65b1305fdb53a772a8908ccb82bd7735358a23be5d2
MD5 5c50433f2ad2596e8a22097210a8e2a5
SHA1 efad1a0268ddbb72645d6dd0ea2dd1c8d769bb41
SHA512 dbcb684929f9355154ba39f28b74441ae2f9caa5413860ef855a695ee839aa8634225c8a4f41657f0f632a6fbb24d285b77655e837750f4030678557b71c8115
SSDEEP 3072:5aaHTwJsefYlzwq92t97b78P6goLvYUEP0J4+pnVnSlxrI0havJy1arY:5BkBfTqUPcP65kU2+93SlRI0havg1
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 266KB

file.exe

IMPHASH 5e8c790316167009ad79ab4dba19f7fb
SHA256 ee63da071d702cc7795ae65b1305fdb53a772a8908ccb82bd7735358a23be5d2
MD5 5c50433f2ad2596e8a22097210a8e2a5
SHA1 efad1a0268ddbb72645d6dd0ea2dd1c8d769bb41
SHA512 dbcb684929f9355154ba39f28b74441ae2f9caa5413860ef855a695ee839aa8634225c8a4f41657f0f632a6fbb24d285b77655e837750f4030678557b71c8115
SSDEEP 3072:5aaHTwJsefYlzwq92t97b78P6goLvYUEP0J4+pnVnSlxrI0havJy1arY:5BkBfTqUPcP65kU2+93SlRI0havg1
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

33103

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetConsoleAliasExesW EnumTimeFormatsA GetCommandLineA GlobalAlloc GetSystemDirectoryW LoadLibraryW GetSystemWindowsDirectoryA GetConsoleAliasExesLengthW DeleteVolumeMountPointW GetFileAttributesA GetExitCodeProcess GetWriteWatch GetStartupInfoW CreateJobObjectA GetPrivateProfileIntW InterlockedExchange SetCurrentDirectoryA GetStartupInfoA GetHandleInformation GetCurrentDirectoryW SetLastError GetProcAddress PeekConsoleInputW RemoveDirectoryA GlobalGetAtomNameA OpenMutexA GetFileType MoveFileA GetModuleHandleW GlobalGetAtomNameW FindNextChangeNotification OpenJobObjectW GlobalWire GetPrivateProfileSectionNamesA EnumDateFormatsA SetConsoleCursorInfo GetModuleHandleA lstrcatW GetProcessAffinityMask FreeEnvironmentStringsW FindNextFileW CreateMailslotA GetStringTypeW EnumDateFormatsW FatalAppExitA SetCalendarInfoA OpenSemaphoreW FindFirstVolumeA SetFileShortNameA GetWindowsDirectoryW GetVolumeNameForVolumeMountPointW ReadConsoleOutputCharacterW EnumSystemLocalesW CommConfigDialogW DeleteFileA SetStdHandle WriteConsoleW FreeEnvironmentStringsA InterlockedDecrement GetNumberFormatW GetConsoleAliasA CreateFileW CloseHandle WideCharToMultiByte InterlockedIncrement InterlockedCompareExchange MultiByteToWideChar EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLastError HeapFree HeapAlloc GetCommandLineW HeapSetInformation GetCPInfo RaiseException RtlUnwind LCMapStringW GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess HeapCreate ExitProcess WriteFile GetStdHandle GetModuleFileNameW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetLocaleInfoW IsProcessorFeaturePresent HeapSize GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale HeapReAlloc GetConsoleCP GetConsoleMode FlushFileBuffers ReadFile SetFilePointer

user32

GetAltTabInfoW

gdi32

SelectPalette GetCharABCWidthsW GetTextFaceA

winhttp

WinHttpConnect

Sharing