file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 434KB
Sample230916-dqq5hsgf3x
SHA256 11bef9e9d9d25f2c184c8343840dd5231b61dc374b3b360e2d7cd9d4cb5c8063
MD5 add1e90b74d8db89354419ea576ab892
SHA1 ca833b01f357fc11ac3a41d729891dd758a38c16
SHA512 2bb14f99039b53aafeae4bc72c4e1e6c8aa1123b05df6551c34aa091f77f0b0abf8eb8f07c6a25c0143caca6db2857f784e2afb61da1ecd68c96dcb27e6edc90
SSDEEP 6144:8F8v1sjHwykPVZ5uZgNSi4fPwu331cl6zuCte+IfPpjHMvzGbL4LSD:8uujZ9Zg6w+8wofPpYv5u
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 434KB

file.exe

IMPHASH a9bf299729b09a43be583e7770d2853b
SHA256 11bef9e9d9d25f2c184c8343840dd5231b61dc374b3b360e2d7cd9d4cb5c8063
MD5 add1e90b74d8db89354419ea576ab892
SHA1 ca833b01f357fc11ac3a41d729891dd758a38c16
SHA512 2bb14f99039b53aafeae4bc72c4e1e6c8aa1123b05df6551c34aa091f77f0b0abf8eb8f07c6a25c0143caca6db2857f784e2afb61da1ecd68c96dcb27e6edc90
SSDEEP 6144:8F8v1sjHwykPVZ5uZgNSi4fPwu331cl6zuCte+IfPpjHMvzGbL4LSD:8uujZ9Zg6w+8wofPpYv5u
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

23609

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

MoveFileExA SystemTimeToTzSpecificLocalTime InterlockedDecrement SetDefaultCommConfigW GetEnvironmentStringsW SetConsoleScreenBufferSize SetVolumeMountPointW BackupSeek GetModuleHandleW GetNumberFormatA SetFileTime GetConsoleAliasExesW GetCommandLineA GetDriveTypeA GetEnvironmentStrings GetPrivateProfileIntA LoadLibraryW TerminateThread CopyFileW SetConsoleCP GetVolumePathNameA GetStartupInfoW CreateJobObjectA OpenMutexW GetHandleInformation GetLastError GetCurrentDirectoryW GetNumaProcessorNode EnumSystemCodePagesW LoadLibraryA GetProcessId LocalAlloc GetFileType RemoveDirectoryW GetProfileStringA FindNextChangeNotification FindAtomA GlobalWire EnumDateFormatsA GetModuleHandleA FreeEnvironmentStringsW FindNextFileW VirtualProtect GetCurrentDirectoryA EnumDateFormatsW FatalAppExitA GetShortPathNameW OpenSemaphoreW FindAtomW GetWindowsDirectoryW FindFirstVolumeW AddConsoleAliasA CreateFileW GetConsoleAliasesLengthW FindFirstFileW GetComputerNameA EnumResourceNamesW SetLastError GetCommandLineW CloseHandle ReadFile FlushFileBuffers GetStringTypeW HeapFree HeapAlloc GetProcAddress ExitProcess DecodePointer DeleteFileA EncodePointer HeapReAlloc HeapSetInformation RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess IsProcessorFeaturePresent HeapCreate WriteFile GetStdHandle GetModuleFileNameW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId Sleep HeapSize SetHandleCount QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind MultiByteToWideChar SetStdHandle WriteConsoleW LCMapStringW

user32

GetListBoxInfo CharUpperW

gdi32

SelectPalette GetTextFaceW GetCharWidthW

advapi32

LookupAccountSidW

shell32

DragFinish

ole32

CoGetInstanceFromFile

winhttp

WinHttpWriteData