file[.]exe | Triage™

General

Target
file.exe
Size 423KB
Sample230830-rnfsnafh68
SHA256 81acd032cf67c7b8900ae5294c6764bdbbbcc2cc8eb01160cde3986348381736
MD5 f74cdc139f6ef910eab28f516f30ecf2
SHA1 90ba97c44d54313f2644b7bef6d2e7c35c88c7f9
SHA512 72ff9367c68f48c59b67f2d964509d8fa55893c3a1794541657a03cb7cbb28cdea1d97e9e8102db29c9b5ff08ff04d8860d72862dc8f1157725a5db32ac51e41
SSDEEP 6144:FJUpCH+oSSB8YiEeS5HtOCD9Hr9NraTI9YpTXbJT7ZXpcaWxJilhbIDi6:PUVBSB8YiEqWHrfegYpZZXpoxJuhU
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 423KB

file.exe

IMPHASH 802684cf005d747b242e1f448e79d752
SHA256 81acd032cf67c7b8900ae5294c6764bdbbbcc2cc8eb01160cde3986348381736
MD5 f74cdc139f6ef910eab28f516f30ecf2
SHA1 90ba97c44d54313f2644b7bef6d2e7c35c88c7f9
SHA512 72ff9367c68f48c59b67f2d964509d8fa55893c3a1794541657a03cb7cbb28cdea1d97e9e8102db29c9b5ff08ff04d8860d72862dc8f1157725a5db32ac51e41
SSDEEP 6144:FJUpCH+oSSB8YiEeS5HtOCD9Hr9NraTI9YpTXbJT7ZXpcaWxJilhbIDi6:PUVBSB8YiEqWHrfegYpZZXpoxJuhU
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

37341

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

EnumDateFormatsExW GetNumaProcessorNode GetConsoleAliasExesA MoveFileExA DeleteVolumeMountPointA InterlockedIncrement GetConsoleAliasA HeapFree OpenSemaphoreA GetModuleHandleW GetTickCount EnumTimeFormatsW GetDriveTypeA AllocateUserPhysicalPages GlobalAlloc GetPrivateProfileIntA SetFileShortNameW LoadLibraryW IsValidLocale GetConsoleAliasW RaiseException CreateJobObjectA EnumSystemLocalesA InterlockedExchange GetStartupInfoA GetHandleInformation GetCurrentDirectoryW SetLastError GetFileSize PeekConsoleInputW MoveFileW LoadLibraryA OpenMutexA InterlockedExchangeAdd SetCalendarInfoW BuildCommDCBAndTimeoutsW RemoveDirectoryW GlobalGetAtomNameW AddAtomA GetPrivateProfileSectionNamesA FindNextFileA GlobalUnWire GetModuleHandleA FatalExit FreeEnvironmentStringsW FindNextFileW RequestWakeupLatency VirtualProtect GetCurrentDirectoryA FatalAppExitA OpenSemaphoreW FindFirstVolumeA GetWindowsDirectoryW EnumCalendarInfoExA CommConfigDialogW EnumResourceNamesW GetCommandLineW ReadConsoleOutputCharacterA GetVolumeNameForVolumeMountPointA CloseHandle CreateFileW WideCharToMultiByte InterlockedDecrement InterlockedCompareExchange MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLastError DeleteFileA HeapSetInformation GetStartupInfoW GetCPInfo RtlUnwind HeapAlloc LCMapStringW IsProcessorFeaturePresent HeapCreate UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetProcAddress ExitProcess WriteFile GetModuleFileNameW GetEnvironmentStringsW TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetLocaleInfoW HeapSize GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID GetLocaleInfoA HeapReAlloc SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers ReadFile SetStdHandle WriteConsoleW

gdi32

SelectPalette GetCharABCWidthsW GetTextFaceA

shell32

DuplicateIcon

Sharing