file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 460KB
Sample230912-bws5yscd9t
SHA256 cffa16329e13d62acf61bc633131673dd876a04ed8dd76d178fa98a87e2ee2bb
MD5 16d80587a3a156f92c76ed1570e0374c
SHA1 e8e59fab4f328610f173edc1af44027eebba98dd
SHA512 6181fe68b9fe56b33803078b64ed51f9dea2a41be2974b1e70517d2b33643ec270f22f62ef37a1c5c17338c5b4bf9b376557ad4d256f5c89b91495bef225ae33
SSDEEP 6144:xw5o6o0g4cUVQ9E8C2j1SWQZ2q/jh9pSmWpfP0/R5VonGg9RcH:x1b0g4VQ28HSW2/jFPhkGgn
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 460KB

file.exe

IMPHASH 9ae33731e854d7500b6b6eac229715f1
SHA256 cffa16329e13d62acf61bc633131673dd876a04ed8dd76d178fa98a87e2ee2bb
MD5 16d80587a3a156f92c76ed1570e0374c
SHA1 e8e59fab4f328610f173edc1af44027eebba98dd
SHA512 6181fe68b9fe56b33803078b64ed51f9dea2a41be2974b1e70517d2b33643ec270f22f62ef37a1c5c17338c5b4bf9b376557ad4d256f5c89b91495bef225ae33
SSDEEP 6144:xw5o6o0g4cUVQ9E8C2j1SWQZ2q/jh9pSmWpfP0/R5VonGg9RcH:x1b0g4VQ28HSW2/jFPhkGgn
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28220

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetDriveTypeW EnumCalendarInfoW MoveFileExW InterlockedDecrement CreateJobObjectW SetHandleInformation GetProfileStringW SetVolumeMountPointW GetComputerNameW FreeEnvironmentStringsA GetModuleHandleW GenerateConsoleCtrlEvent GetConsoleAliasesLengthA GetConsoleAliasExesW EnumTimeFormatsA EnumTimeFormatsW TzSpecificLocalTimeToSystemTime GetEnvironmentStrings GetConsoleCP GlobalAlloc LoadLibraryW TerminateThread FatalAppExitW GetCalendarInfoW GetStartupInfoW RaiseException GetPrivateProfileIntW InterlockedExchange GetStartupInfoA SetThreadLocale GetLastError GetCurrentDirectoryW GetNumaProcessorNode PeekConsoleInputW MoveFileW EnumSystemCodePagesW OpenMutexA GetProcessId LocalAlloc BuildCommDCBAndTimeoutsW GetNumberFormatW RemoveDirectoryW GlobalGetAtomNameW FindNextFileA EnumDateFormatsA GlobalUnWire GetModuleHandleA SetLocaleInfoW EnumResourceNamesA CreateMailslotA VirtualProtect EnumDateFormatsW GetShortPathNameW OpenSemaphoreW FindFirstVolumeA FindAtomW FindFirstVolumeW GetVolumeNameForVolumeMountPointW DeleteFileW AddConsoleAliasA CreateFileW ReadFile FlushFileBuffers FindFirstFileW SetDefaultCommConfigA GetCommandLineW GetFileSize BackupRead WriteConsoleW SetStdHandle InterlockedIncrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer HeapFree HeapAlloc GetProcAddress ExitProcess DeleteFileA HeapSetInformation RtlUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess IsProcessorFeaturePresent HeapCreate WriteFile GetStdHandle GetModuleFileNameW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId HeapSize FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage GetStringTypeW MultiByteToWideChar SetFilePointer WideCharToMultiByte GetConsoleMode HeapReAlloc LCMapStringW CloseHandle

user32

CharUpperW LoadMenuA

gdi32

SelectPalette GetTextFaceW

advapi32

LookupAccountSidW

shell32

DragFinish