file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 430KB
Sample230906-n1qa3sfb2x
SHA256 bb4ce1a7fde48fb1ad284972ab234f7e6bbcc3d4bcb08227ad9f2c0d9f5d7dea
MD5 d16df14e7ab6d0602ec366bfdf077aa8
SHA1 1a2a34c0509723f833c6a4856f870bba4f5faa49
SHA512 8354c6980f0d678932e02b50265a1c6fd7cb77b6af4c16b957fb0177c848beb3f11e5bd134f87c923ca2f2ca385c8e398e42f45d1dc322bf272199e828b2742d
SSDEEP 6144:vVlEfviruq6/9QFACKE5F13DSpxyXuWGMp0kKjalYFDiQkbqGaKRR1h:96vJqI9QFAmFU6jbcFu1naKR
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 430KB

file.exe

IMPHASH 07e73f5e37457f017912d14098764519
SHA256 bb4ce1a7fde48fb1ad284972ab234f7e6bbcc3d4bcb08227ad9f2c0d9f5d7dea
MD5 d16df14e7ab6d0602ec366bfdf077aa8
SHA1 1a2a34c0509723f833c6a4856f870bba4f5faa49
SHA512 8354c6980f0d678932e02b50265a1c6fd7cb77b6af4c16b957fb0177c848beb3f11e5bd134f87c923ca2f2ca385c8e398e42f45d1dc322bf272199e828b2742d
SSDEEP 6144:vVlEfviruq6/9QFACKE5F13DSpxyXuWGMp0kKjalYFDiQkbqGaKRR1h:96vJqI9QFAmFU6jbcFu1naKR
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

39146

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

MoveFileExW GetConsoleAliasA InterlockedDecrement GetCurrentProcess CreateJobObjectW GetEnvironmentStringsW SetHandleInformation GetUserDefaultLCID OpenSemaphoreA GetModuleHandleW GetTickCount GenerateConsoleCtrlEvent EnumTimeFormatsA EnumTimeFormatsW GetCommandLineA GetDriveTypeA GetEnvironmentStrings GlobalAlloc GetPrivateProfileIntA LoadLibraryW IsValidLocale GetCalendarInfoA SetVolumeMountPointA GetConsoleAliasW TerminateProcess GetStartupInfoW InterlockedExchange FindFirstFileA OpenMutexW SetLastError EnumDateFormatsExA CommConfigDialogA EnumSystemCodePagesW GlobalFree GetNumaHighestNodeNumber LoadLibraryA UnhandledExceptionFilter GetFileType MoveFileA BuildCommDCBAndTimeoutsW AddVectoredExceptionHandler AddAtomW GlobalGetAtomNameW FindNextChangeNotification FindNextFileA EnumDateFormatsA GlobalUnWire GetModuleHandleA SetLocaleInfoW FindNextFileW CreateMailslotA VirtualProtect GetCurrentDirectoryA FatalAppExitA PeekConsoleInputA GetShortPathNameW OpenSemaphoreW FindFirstVolumeA ReadConsoleOutputCharacterW EnumCalendarInfoExA ReadFile WriteConsoleW GetConsoleAliasExesA EnumResourceNamesW GetVolumeNameForVolumeMountPointA GetPrivateProfileSectionNamesW GetCommandLineW RemoveDirectoryA FlushFileBuffers SetStdHandle GetConsoleMode GetConsoleCP SetFilePointer WideCharToMultiByte InterlockedIncrement InterlockedCompareExchange MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLastError HeapFree HeapAlloc DeleteFileA HeapSetInformation GetCPInfo RaiseException RtlUnwind LCMapStringW GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId GetProcAddress SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapCreate ExitProcess WriteFile GetStdHandle GetModuleFileNameW CloseHandle FreeEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetLocaleInfoW HeapSize GetLocaleInfoA EnumSystemLocalesA HeapReAlloc CreateFileW

user32

GetMessagePos

gdi32

GetCharABCWidthsW GetTextFaceW SelectPalette

advapi32

LookupAccountSidW

shell32

DragFinish

ole32

CoGetInstanceFromFile

winhttp

WinHttpSetOption