file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 214KB
Sample230905-a4mgpscb9s
SHA256 b07f239481c03cfb14e4ed10dd4e2ee4a5e0f552d10bfcac29980afb565fbde1
MD5 6b9d38d4c48cefbc61a02fe1901841ad
SHA1 aca2eb2f88fb8d75d8be4c5b78953fa345040e2d
SHA512 6f49d9f6e04104e4c9816ee65ed21b4f65d3034c638c7d1384cb3edf85e5748ffc62ae7947e0e01b27b6f091f6b56849ff5a6ebae4ec12947567479d016315f4
SSDEEP 3072:wFNhxttOhBDV5+LMea3xb485lAOX0tk2zoMbi07EK364Y:kdOhBB5+LMeahx5+OX0tkpM1
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 214KB

file.exe

IMPHASH 560ade47cf330e07b01243fb5f60f57b
SHA256 b07f239481c03cfb14e4ed10dd4e2ee4a5e0f552d10bfcac29980afb565fbde1
MD5 6b9d38d4c48cefbc61a02fe1901841ad
SHA1 aca2eb2f88fb8d75d8be4c5b78953fa345040e2d
SHA512 6f49d9f6e04104e4c9816ee65ed21b4f65d3034c638c7d1384cb3edf85e5748ffc62ae7947e0e01b27b6f091f6b56849ff5a6ebae4ec12947567479d016315f4
SSDEEP 3072:wFNhxttOhBDV5+LMea3xb485lAOX0tk2zoMbi07EK364Y:kdOhBB5+LMeahx5+OX0tkpM1
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13121

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentProcess CreateJobObjectW HeapFree GetEnvironmentStringsW SetHandleInformation GetUserDefaultLCID GetModuleHandleW EnumCalendarInfoExW GenerateConsoleCtrlEvent GetConsoleAliasExesW EnumTimeFormatsA EnumTimeFormatsW GetCommandLineA GetDriveTypeA GetEnvironmentStrings GlobalAlloc LoadLibraryW IsValidLocale GetCalendarInfoA SetVolumeMountPointA GetExitCodeProcess GetConsoleAliasW GetStartupInfoW GetPrivateProfileIntW InterlockedExchange FindFirstFileA OpenMutexW SetLastError EnumDateFormatsExA InterlockedDecrement EnumSystemCodePagesW GetNumaHighestNodeNumber LoadLibraryA UnhandledExceptionFilter GetFileType MoveFileA AddVectoredExceptionHandler GlobalGetAtomNameW FindNextChangeNotification AddAtomA FindNextFileA EnumDateFormatsA GlobalUnWire SetLocaleInfoW EnumResourceNamesA FindNextFileW CreateMailslotA VirtualProtect GetCurrentDirectoryA FatalAppExitA PeekConsoleInputA GetShortPathNameW OpenSemaphoreW FindFirstVolumeA ReadConsoleOutputCharacterW CreateFileW MoveFileExW CommConfigDialogA GetPrivateProfileSectionNamesW GetVolumeNameForVolumeMountPointA GetCommandLineW RemoveDirectoryA ReadFile FlushFileBuffers HeapSize GetLastError HeapAlloc DeleteFileA HeapSetInformation DecodePointer SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess IsProcessorFeaturePresent HeapCreate GetProcAddress ExitProcess WriteFile GetStdHandle GetModuleFileNameW EnterCriticalSection LeaveCriticalSection FreeEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage Sleep RaiseException RtlUnwind MultiByteToWideChar SetStdHandle WriteConsoleW LCMapStringW GetStringTypeW HeapReAlloc CloseHandle

user32

GetMessagePos

gdi32

SelectPalette GetCharABCWidthsW GetTextFaceW

advapi32

LookupAccountSidW

shell32

DragFinish

winhttp

WinHttpWriteData