file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 253KB
Sample230917-tgrmpadf64
SHA256 69a871ba7d2670d162b2feffd9665fcebc4101a47d7892be98c3abbd602573d9
MD5 afcfdec7f1675a6b234d4ac2983327d6
SHA1 26fedfcffeb4514a65b5fe05676eb1e9d0c6eec8
SHA512 60209244040826bbedf10e345e6ef1ac3fa0c44270cc0aa21b4e12ae84fe5858412994957003b9bcd8ac24e0618c40412e3bb2fa5b591082f67fcb97a97d9a0f
SSDEEP 3072:Ze1mM1SeATLuEayh1M8yOINUQjwAccQNZiVWZ5AYShN:DMMeAbayL7IWQwA9QrOu55
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 253KB

file.exe

IMPHASH 0247adcd329847ea0db225ff728b6ec9
SHA256 69a871ba7d2670d162b2feffd9665fcebc4101a47d7892be98c3abbd602573d9
MD5 afcfdec7f1675a6b234d4ac2983327d6
SHA1 26fedfcffeb4514a65b5fe05676eb1e9d0c6eec8
SHA512 60209244040826bbedf10e345e6ef1ac3fa0c44270cc0aa21b4e12ae84fe5858412994957003b9bcd8ac24e0618c40412e3bb2fa5b591082f67fcb97a97d9a0f
SSDEEP 3072:Ze1mM1SeATLuEayh1M8yOINUQjwAccQNZiVWZ5AYShN:DMMeAbayL7IWQwA9QrOu55
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13701

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ReadConsoleA InterlockedDecrement SetDefaultCommConfigW GetEnvironmentStringsW GetProfileStringW GetUserDefaultLCID SetConsoleScreenBufferSize AddConsoleAliasW SetVolumeMountPointW GetComputerNameW GetModuleHandleW GetCommConfig GetConsoleAliasesLengthA SetFileTime GetCommandLineA GetDriveTypeA GetEnvironmentStrings LoadLibraryW TerminateThread FatalAppExitW ReadConsoleInputA CopyFileW SetConsoleCP EnumSystemCodePagesA GetACP GetVolumePathNameA MoveFileExW CreateJobObjectA GetPrivateProfileIntW FindFirstFileA GetLastError GetCurrentDirectoryW SetLastError LoadLibraryA OpenMutexA GetProcessId LocalAlloc GetFileType GetNumberFormatW RemoveDirectoryW GetModuleHandleA FreeEnvironmentStringsW EnumResourceNamesA FindNextFileW VirtualProtect GetCurrentDirectoryA EnumDateFormatsW GetShortPathNameW OpenSemaphoreW FindFirstVolumeA FindAtomW GetWindowsDirectoryW SetStdHandle WriteConsoleW GetConsoleAliasExesA FindFirstFileW GetStartupInfoW GetCommandLineW CloseHandle CreateFileW MoveFileA HeapFree HeapAlloc EncodePointer DecodePointer HeapSetInformation HeapCreate GetProcAddress ExitProcess WriteFile GetStdHandle GetModuleFileNameW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess Sleep HeapSize EnterCriticalSection LeaveCriticalSection SetHandleCount InitializeCriticalSectionAndSpinCount DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapReAlloc RtlUnwind GetCPInfo GetOEMCP IsValidCodePage WideCharToMultiByte IsProcessorFeaturePresent GetConsoleCP GetConsoleMode FlushFileBuffers LCMapStringW MultiByteToWideChar GetStringTypeW SetFilePointer

user32

CharUpperW

gdi32

SelectPalette GetTextFaceW GetCharWidthA

shell32

DragFinish

winhttp

WinHttpGetProxyForUrl