file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 430KB
Sample230915-v1zcbagg55
SHA256 36e23e6d7b8472c69d30c85fa7ddbefb1ce56e95c82bd1848eaa1698068337c2
MD5 789fc39d539c14b45b4647f64b991629
SHA1 70ba7fe2c972210feafb6cd75760e0d789a92b92
SHA512 11accad18c322e54038b3bcf078400f778adb3e82a756a69f75e3153e50749bcdf333cd7a774c17ada125315d30f4a532edbac9065c27dbd935a6f0e081e7a27
SSDEEP 6144:xXJtXTZ7q99g1yEr0gCEhBCCL2ywO554UsRipEexr+Wk0RlZV:x/97qrUrN92DO55NsyZxr+sRl
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 430KB

file.exe

IMPHASH c613086c29a691857f172134e78f9db9
SHA256 36e23e6d7b8472c69d30c85fa7ddbefb1ce56e95c82bd1848eaa1698068337c2
MD5 789fc39d539c14b45b4647f64b991629
SHA1 70ba7fe2c972210feafb6cd75760e0d789a92b92
SHA512 11accad18c322e54038b3bcf078400f778adb3e82a756a69f75e3153e50749bcdf333cd7a774c17ada125315d30f4a532edbac9065c27dbd935a6f0e081e7a27
SSDEEP 6144:xXJtXTZ7q99g1yEr0gCEhBCCL2ywO554UsRipEexr+Wk0RlZV:x/97qrUrN92DO55NsyZxr+sRl
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

23805

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetNumaProcessorNode MoveFileExA BuildCommDCBAndTimeoutsA SystemTimeToTzSpecificLocalTime InterlockedDecrement SetDefaultCommConfigW GetEnvironmentStringsW AddConsoleAliasW GetModuleHandleW GenerateConsoleCtrlEvent GetNumberFormatA SetFileTime GetConsoleAliasExesW EnumTimeFormatsA GetCommandLineA GetDriveTypeA GetEnvironmentStrings GetPrivateProfileIntA LoadLibraryW TerminateThread FatalAppExitW CopyFileW SetVolumeMountPointA SetConsoleCP SetConsoleCursorPosition GetVolumePathNameA GetStartupInfoW CreateMailslotW CreateJobObjectA InterlockedExchange SetThreadLocale OpenMutexW GetHandleInformation GetConsoleAliasesLengthW GetCurrentDirectoryW SetLastError BackupRead PeekConsoleInputW EnumSystemCodePagesW LoadLibraryA GetProcessId InterlockedExchangeAdd LocalAlloc GetFileType RemoveDirectoryW GetProfileStringA FindNextChangeNotification FindAtomA GlobalWire EnumDateFormatsA GetModuleHandleA SetLocaleInfoW FreeEnvironmentStringsW FindNextFileW VirtualProtect GetCurrentDirectoryA EnumDateFormatsW GetShortPathNameW OpenSemaphoreW FindAtomW GetWindowsDirectoryW FindFirstVolumeW DeleteFileW CreateFileW EnumCalendarInfoA GetCommandLineW FindFirstFileW EnumResourceNamesW GetComputerNameA GetLastError ReadFile GetStringTypeW LCMapStringW WriteConsoleW HeapAlloc GetProcAddress ExitProcess DecodePointer DeleteFileA EncodePointer HeapReAlloc HeapSetInformation RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess HeapFree IsProcessorFeaturePresent WriteFile GetStdHandle GetModuleFileNameW HeapCreate EnterCriticalSection LeaveCriticalSection SetFilePointer SetHandleCount InitializeCriticalSectionAndSpinCount DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId Sleep HeapSize QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime WideCharToMultiByte GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage SetStdHandle FlushFileBuffers RtlUnwind MultiByteToWideChar CloseHandle

user32

GetListBoxInfo CharUpperW

gdi32

GetCharWidthW GetTextFaceW SelectPalette

advapi32

LookupAccountSidW

shell32

DragFinish

ole32

CoGetInstanceFromFile

winhttp

WinHttpWriteData