file[.]exe | Triage™

General

Target
file.exe
Size 250KB
Sample230910-jensxaff38
SHA256 ae124eaa39189cfaa3cd5a74837e40732efdf6e1850e3dccebd903fb0d619482
MD5 479df8b150fe48b3b1dda6405214371b
SHA1 cf6badcdf1d3104aa14754b6534c156ac8d57706
SHA512 7a51e021d72893e69aaac1a79ae0880834cb890562a1df34d92f45f41fe0e7042db1c077a75ea0ae81c5e45d126647360ec780af1e26bad9f921e06a72b8a8d7
SSDEEP 3072:qByI/LHnUEG9JOkU2jORzGprTugB49y7F0jsHRG5ds+X2:Sr/LHIrOk5xBy2uy6jfw+
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 250KB

file.exe

IMPHASH 3681be0c4196dc1f0159e8326f6ce58b
SHA256 ae124eaa39189cfaa3cd5a74837e40732efdf6e1850e3dccebd903fb0d619482
MD5 479df8b150fe48b3b1dda6405214371b
SHA1 cf6badcdf1d3104aa14754b6534c156ac8d57706
SHA512 7a51e021d72893e69aaac1a79ae0880834cb890562a1df34d92f45f41fe0e7042db1c077a75ea0ae81c5e45d126647360ec780af1e26bad9f921e06a72b8a8d7
SSDEEP 3072:qByI/LHnUEG9JOkU2jORzGprTugB49y7F0jsHRG5ds+X2:Sr/LHIrOk5xBy2uy6jfw+
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

25770

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateFileA FindFirstChangeNotificationW GetConsoleAliasesLengthW PeekNamedPipe SetEndOfFile CancelWaitableTimer CreateHardLinkA FreeEnvironmentStringsA GetTickCount GetDateFormatA ReadConsoleInputA SizeofResource GetFileAttributesW FileTimeToSystemTime GlobalUnlock GetShortPathNameA FindFirstFileA GetLogicalDriveStringsA GetLastError SetLastError GetTempFileNameW AttachConsole VirtualAlloc BeginUpdateResourceW LoadLibraryA SetConsoleCtrlHandler SetFileApisToANSI OpenJobObjectW FoldStringA GetModuleHandleA SetCalendarInfoA FindFirstVolumeW ReadConsoleOutputCharacterW LCMapStringW WideCharToMultiByte LCMapStringA GetProcAddress InterlockedIncrement InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW RaiseException RtlUnwind HeapFree HeapAlloc GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime HeapSize HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW InitializeCriticalSectionAndSpinCount

user32

LoadMenuA DdeQueryStringW GetClassInfoExW GetKeyNameTextW CharToOemBuffW GetMessageExtraInfo

gdi32

CreateDCA

Sharing