file[.]exe | Triage™

General

Target
file.exe
Size 250KB
Sample230910-cs1ajaeh62
SHA256 436df5626a5852dbc7e583a9539f55d068e65d9b6cd62b339c64dd2a87f4ad46
MD5 35aa9f3afd14c7114b8f6104ae840b80
SHA1 a1c843ba960a10023e53d89edf01ca745028e99f
SHA512 8098c1f0eb82df507a7e140740228f64f6dc516415173a46c214c2539af54b08581731b09b42d38e91d94a4db2dd97d26f2ae4bed4c44fbe2333b319a1feeaa1
SSDEEP 3072:JBJnfLOXUEGsJNijF7iPMX/DhupqM5aVmbycHRGxiN/oX2H:jpfLO4CNih7BwAmbaSwG
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 250KB

file.exe

IMPHASH 3681be0c4196dc1f0159e8326f6ce58b
SHA256 436df5626a5852dbc7e583a9539f55d068e65d9b6cd62b339c64dd2a87f4ad46
MD5 35aa9f3afd14c7114b8f6104ae840b80
SHA1 a1c843ba960a10023e53d89edf01ca745028e99f
SHA512 8098c1f0eb82df507a7e140740228f64f6dc516415173a46c214c2539af54b08581731b09b42d38e91d94a4db2dd97d26f2ae4bed4c44fbe2333b319a1feeaa1
SSDEEP 3072:JBJnfLOXUEGsJNijF7iPMX/DhupqM5aVmbycHRGxiN/oX2H:jpfLO4CNih7BwAmbaSwG
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

25770

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateFileA FindFirstChangeNotificationW GetConsoleAliasesLengthW PeekNamedPipe SetEndOfFile CancelWaitableTimer CreateHardLinkA FreeEnvironmentStringsA GetTickCount GetDateFormatA ReadConsoleInputA SizeofResource GetFileAttributesW FileTimeToSystemTime GlobalUnlock GetShortPathNameA FindFirstFileA GetLogicalDriveStringsA GetLastError SetLastError GetTempFileNameW AttachConsole VirtualAlloc BeginUpdateResourceW LoadLibraryA SetConsoleCtrlHandler SetFileApisToANSI OpenJobObjectW FoldStringA GetModuleHandleA SetCalendarInfoA FindFirstVolumeW ReadConsoleOutputCharacterW LCMapStringW WideCharToMultiByte LCMapStringA GetProcAddress InterlockedIncrement InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW RaiseException RtlUnwind HeapFree HeapAlloc GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime HeapSize HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW InitializeCriticalSectionAndSpinCount

user32

LoadMenuA DdeQueryStringW GetClassInfoExW GetKeyNameTextW CharToOemBuffW GetMessageExtraInfo

gdi32

CreateDCA

Sharing