file[.]exe | Triage™

General

Target
file.exe
Size 243KB
Sample230831-r36bvsfe73
SHA256 d9687211c7a526b2eaedd63975a8a0deef343ec8a01a9480d3bf28316dc57107
MD5 5d9b6231d958f2028159035586a36ab7
SHA1 93e47b4b93ccabd808478169c07a08b16f4bc433
SHA512 74e69d5f2c936752ced85cd922cac1e66dcbe3ebe82816eae0ccc7daf83f1f99811f337ad8474afb8d93131d9bcf7402d61ff5c73bcbc8c8085fa9378f6541d0
SSDEEP 3072:iGsgOTdlneLpakmLCYHdyR4w9t+Eac+0bVsY1ZVKfg7FFPLwdQ6P36wYRbwMlF:EvepakmOYHde5xa7EVvN8S6iLwMl
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 243KB

file.exe

IMPHASH c614d8d8bcef689d6675c8b116f7714c
SHA256 d9687211c7a526b2eaedd63975a8a0deef343ec8a01a9480d3bf28316dc57107
MD5 5d9b6231d958f2028159035586a36ab7
SHA1 93e47b4b93ccabd808478169c07a08b16f4bc433
SHA512 74e69d5f2c936752ced85cd922cac1e66dcbe3ebe82816eae0ccc7daf83f1f99811f337ad8474afb8d93131d9bcf7402d61ff5c73bcbc8c8085fa9378f6541d0
SSDEEP 3072:iGsgOTdlneLpakmLCYHdyR4w9t+Eac+0bVsY1ZVKfg7FFPLwdQ6P36wYRbwMlF:EvepakmOYHde5xa7EVvN8S6iLwMl
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

36932

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

MoveFileExA CommConfigDialogA DeleteVolumeMountPointA GetConsoleAliasA InterlockedDecrement CreateJobObjectW HeapFree GetEnvironmentStringsW SetHandleInformation SetVolumeMountPointW OpenSemaphoreA GetModuleHandleW EnumCalendarInfoExW GetConsoleAliasExesW EnumTimeFormatsW GetUserDefaultLangID GetDriveTypeA AllocateUserPhysicalPages GlobalAlloc GetPrivateProfileIntA LoadLibraryW IsValidLocale GetCalendarInfoW GetStartupInfoW GetStartupInfoA GetCurrentDirectoryW SetLastError ReadConsoleOutputCharacterA GetNumaProcessorNode MoveFileW RemoveDirectoryA EnumSystemCodePagesW LoadLibraryA OpenMutexA UnhandledExceptionFilter InterlockedExchangeAdd GlobalGetAtomNameW AddAtomA GetPrivateProfileSectionNamesA GlobalUnWire GetModuleHandleA SetLocaleInfoW FatalExit FindNextFileW CreateMailslotA VirtualProtect GetCurrentDirectoryA FatalAppExitA PeekConsoleInputA GetShortPathNameW OpenSemaphoreW FindFirstVolumeA GetVolumeNameForVolumeMountPointW GetCurrentProcessId CloseHandle WriteConsoleW GetFileSize EnumResourceNamesW EnumDateFormatsExA GetCommandLineW SetStdHandle CreateFileW WideCharToMultiByte InterlockedIncrement InterlockedCompareExchange InterlockedExchange MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLastError HeapAlloc DeleteFileA HeapSetInformation GetCPInfo RaiseException RtlUnwind LCMapStringW HeapCreate GetProcAddress ExitProcess WriteFile GetStdHandle GetModuleFileNameW SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType FreeEnvironmentStringsW TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime GetLocaleInfoW IsProcessorFeaturePresent HeapSize GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA HeapReAlloc SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers ReadFile

user32

GetMessagePos

gdi32

SelectPalette GetCharABCWidthsW GetTextFaceA

shell32

DuplicateIcon

Sharing