file[.]exe | Triage™

General

Target
file.exe
Size 207KB
Sample230901-arrkwsbe97
SHA256 82ce4a02da068fd7f69b255e60055fbed0fbfaa9dfa15d7aab7185f8dc19f75c
MD5 c44e70f5543625ca259753e5c0919591
SHA1 ac628e27747a79f4b6e74cc2a68740f99d3f69ea
SHA512 d7bda984ca0f6a2f11eaccb6c7102391c20969b4c4f09df070d310371f18ae837733cac1399b4bdb27c84d95821c26e5db03d49c4681df5d7eb68ca19a0641a8
SSDEEP 3072:HLx7kv8RGHBw0FRfyRUNjNWNAcy4LgOmG:rdfRGHBw0FASTIy0VmG
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 207KB

file.exe

IMPHASH 60202b26a1548f32d077efa3514a2fd4
SHA256 82ce4a02da068fd7f69b255e60055fbed0fbfaa9dfa15d7aab7185f8dc19f75c
MD5 c44e70f5543625ca259753e5c0919591
SHA1 ac628e27747a79f4b6e74cc2a68740f99d3f69ea
SHA512 d7bda984ca0f6a2f11eaccb6c7102391c20969b4c4f09df070d310371f18ae837733cac1399b4bdb27c84d95821c26e5db03d49c4681df5d7eb68ca19a0641a8
SSDEEP 3072:HLx7kv8RGHBw0FRfyRUNjNWNAcy4LgOmG:rdfRGHBw0FASTIy0VmG
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12843

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CommConfigDialogA MoveFileExW InterlockedDecrement CreateJobObjectW HeapFree GetEnvironmentStringsW SetHandleInformation SetVolumeMountPointW OpenSemaphoreA GetModuleHandleW EnumCalendarInfoExW GetConsoleAliasExesW EnumTimeFormatsA EnumTimeFormatsW GetUserDefaultLangID GetDriveTypeA AllocateUserPhysicalPages GetEnvironmentStrings GlobalAlloc LoadLibraryW IsValidLocale GetCalendarInfoW GetExitCodeProcess GetConsoleAliasW GetStartupInfoW GetPrivateProfileIntW GetStartupInfoA GetCurrentDirectoryW SetLastError ReadConsoleOutputCharacterA EnumDateFormatsExA FindFirstFileW RemoveDirectoryA EnumSystemCodePagesW GlobalGetAtomNameA GetNumaHighestNodeNumber LoadLibraryA OpenMutexA UnhandledExceptionFilter InterlockedExchangeAdd GlobalGetAtomNameW AddAtomA GetPrivateProfileSectionNamesA FindNextFileA GlobalUnWire GetModuleHandleA SetLocaleInfoW EnumResourceNamesA FindNextFileW CreateMailslotA VirtualProtect GetCurrentDirectoryA FatalAppExitA PeekConsoleInputA GetShortPathNameW OpenSemaphoreW FindFirstVolumeA GetCurrentProcessId GetFileSize GetCommandLineW GetVolumeNameForVolumeMountPointA MoveFileW SetStdHandle GetLastError HeapAlloc DeleteFileA HeapSetInformation EncodePointer DecodePointer IsProcessorFeaturePresent HeapCreate GetProcAddress ExitProcess WriteFile GetStdHandle GetModuleFileNameW EnterCriticalSection LeaveCriticalSection SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess FreeEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime RaiseException Sleep RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage MultiByteToWideChar WideCharToMultiByte HeapSize HeapReAlloc GetConsoleCP GetConsoleMode FlushFileBuffers LCMapStringW GetStringTypeW ReadFile CloseHandle WriteConsoleW SetFilePointer CreateFileW

user32

GetMessagePos

gdi32

GetTextFaceA SelectPalette GetCharABCWidthsW

shell32

DuplicateIcon

Sharing