file[.]exe | Triage™

General

Target
file.exe
Size 392KB
Sample230920-p73enaad45
SHA256 a2af9ebda6b57e38dceff2cfe34aaecd19f0c4bb5e1b3f91524324d0fd52de80
MD5 18eda642c0fe68ab57c4899d528af5f6
SHA1 496b288668f7a4e57183ea9c67b0371ba5461d20
SHA512 c08ca40b6a3c8034428cb3c5d6fe52921c177417a05a15ee4055da26004b47d38c24f4aba4b1ad2e142de78a9d1a1999d0085544d7a89d107077cf47410ef3d8
SSDEEP 6144:8DoJjYAa3AKbylyCzc61YCyE2vtqb6dXYuP/JjcCTa:2usAaFyoCAdGetqSYOSy
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 392KB

file.exe

IMPHASH c9420ade60b1def8d80cadba5c09306a
SHA256 a2af9ebda6b57e38dceff2cfe34aaecd19f0c4bb5e1b3f91524324d0fd52de80
MD5 18eda642c0fe68ab57c4899d528af5f6
SHA1 496b288668f7a4e57183ea9c67b0371ba5461d20
SHA512 c08ca40b6a3c8034428cb3c5d6fe52921c177417a05a15ee4055da26004b47d38c24f4aba4b1ad2e142de78a9d1a1999d0085544d7a89d107077cf47410ef3d8
SSDEEP 6144:8DoJjYAa3AKbylyCzc61YCyE2vtqb6dXYuP/JjcCTa:2usAaFyoCAdGetqSYOSy
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

30707

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateFileA SetThreadContext FindFirstChangeNotificationW WriteConsoleInputW SetFilePointer PeekNamedPipe SetConsoleTextAttribute OpenJobObjectA InterlockedCompareExchange CreateHardLinkA FreeEnvironmentStringsA GetTickCount GetGeoInfoW GetDateFormatA LoadLibraryW SizeofResource GetFileAttributesW FileTimeToSystemTime SetThreadPriority GlobalUnlock GetShortPathNameA GetLogicalDriveStringsA GetLastError ReadConsoleOutputCharacterA GetProcAddress VirtualAlloc BeginUpdateResourceW BackupWrite GetTempFileNameA LoadLibraryA CreateHardLinkW FoldStringA GetModuleFileNameA FindNextFileA EnumResourceNamesA OpenSemaphoreW FindFirstVolumeA GetConsoleProcessList FindNextVolumeA WriteConsoleW GetConsoleOutputCP WriteConsoleA ReadFile InterlockedIncrement InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapFree TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA GetStartupInfoA RtlUnwind RaiseException LCMapStringA WideCharToMultiByte MultiByteToWideChar LCMapStringW GetCPInfo HeapAlloc HeapCreate VirtualFree HeapReAlloc GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId SetHandleCount GetStdHandle GetFileType ExitProcess WriteFile GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime HeapSize GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW InitializeCriticalSectionAndSpinCount CloseHandle GetConsoleCP GetConsoleMode GetLocaleInfoW GetModuleHandleA FlushFileBuffers SetStdHandle SetEndOfFile GetProcessHeap

user32

GetMessageExtraInfo LoadMenuA DdeQueryStringW GetClassInfoExW CharToOemBuffA

Sharing