file[.]exe | Triage™

General

Target
file.exe
Size 250KB
Sample230910-h8ydrsfe96
SHA256 8c17d5b20427304dc69fe6c8b4e203fa8077ccb1a252caec921c1586132758cd
MD5 0d223ae59e8285e57e838b1e19be662d
SHA1 6c55f1f879721fca7cb650ddb541e3d5bae20c23
SHA512 5bffe4a115fb59634f6722e295abbedcd79c1c2453d3736b59108a59c863a2600e372c582bbcdc0f09921427e42e89c16697cb18fcca4a406d0d00519bea86e4
SSDEEP 3072:QBcFI/LHnUEG9JDE8SOE9y++Nz0NFbnEcH1MTYazNqFCaHRGoPX2:wR/LHIrYHt/2z0PbxH1MnocBy
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 250KB

file.exe

IMPHASH 3681be0c4196dc1f0159e8326f6ce58b
SHA256 8c17d5b20427304dc69fe6c8b4e203fa8077ccb1a252caec921c1586132758cd
MD5 0d223ae59e8285e57e838b1e19be662d
SHA1 6c55f1f879721fca7cb650ddb541e3d5bae20c23
SHA512 5bffe4a115fb59634f6722e295abbedcd79c1c2453d3736b59108a59c863a2600e372c582bbcdc0f09921427e42e89c16697cb18fcca4a406d0d00519bea86e4
SSDEEP 3072:QBcFI/LHnUEG9JDE8SOE9y++Nz0NFbnEcH1MTYazNqFCaHRGoPX2:wR/LHIrYHt/2z0PbxH1MnocBy
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

25770

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateFileA FindFirstChangeNotificationW GetConsoleAliasesLengthW PeekNamedPipe SetEndOfFile CancelWaitableTimer CreateHardLinkA FreeEnvironmentStringsA GetTickCount GetDateFormatA ReadConsoleInputA SizeofResource GetFileAttributesW FileTimeToSystemTime GlobalUnlock GetShortPathNameA FindFirstFileA GetLogicalDriveStringsA GetLastError SetLastError GetTempFileNameW AttachConsole VirtualAlloc BeginUpdateResourceW LoadLibraryA SetConsoleCtrlHandler SetFileApisToANSI OpenJobObjectW FoldStringA GetModuleHandleA SetCalendarInfoA FindFirstVolumeW ReadConsoleOutputCharacterW LCMapStringW WideCharToMultiByte LCMapStringA GetProcAddress InterlockedIncrement InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW RaiseException RtlUnwind HeapFree HeapAlloc GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime HeapSize HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW InitializeCriticalSectionAndSpinCount

user32

LoadMenuA DdeQueryStringW GetClassInfoExW GetKeyNameTextW CharToOemBuffW GetMessageExtraInfo

gdi32

CreateDCA

Sharing