file[.]exe | Triage™

General

Target
file.exe
Size 294KB
Sample230922-bp4ccade63
SHA256 bd1a7304c5cc386fb5b1291dc81a28c2fd6d9c6189fab48fffd31e1ddd18ddd1
MD5 0ad8d40baae0644d4e3d994c5a8405ac
SHA1 ce9da8f3d3a618571e7c51e0dc42133e26ded313
SHA512 e86d07ef2812cf26f2daf6b67dcff19ab05e516bddf2305507e94ca441af55e5e836e68d45602e33354c3fae88a27299f7f6a250c36fbec0d8e1f3fe4079b966
SSDEEP 3072:peJCXZpXSivGjYTBxSrTRKTABujHdYoJWxg1NsyfkAhhigM+kiMg87dB:OCZtSdSxWTAJ0xgI8kShigUg8Z
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 294KB

file.exe

IMPHASH 7f5ebfefac7f02e8617b9aa5659c8d4e
SHA256 bd1a7304c5cc386fb5b1291dc81a28c2fd6d9c6189fab48fffd31e1ddd18ddd1
MD5 0ad8d40baae0644d4e3d994c5a8405ac
SHA1 ce9da8f3d3a618571e7c51e0dc42133e26ded313
SHA512 e86d07ef2812cf26f2daf6b67dcff19ab05e516bddf2305507e94ca441af55e5e836e68d45602e33354c3fae88a27299f7f6a250c36fbec0d8e1f3fe4079b966
SSDEEP 3072:peJCXZpXSivGjYTBxSrTRKTABujHdYoJWxg1NsyfkAhhigM+kiMg87dB:OCZtSdSxWTAJ0xgI8kShigUg8Z
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

23449

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetLocaleInfoA EnumCalendarInfoA GetConsoleAliasesLengthW GetConsoleAliasExesA GetDriveTypeW FindResourceW MoveFileExW SetDefaultCommConfigW CreateJobObjectW GetNamedPipeHandleStateA SetConsoleScreenBufferSize WriteConsoleInputA GetTimeFormatA SetCommBreak GetSystemDefaultLCID FreeEnvironmentStringsA ReadConsoleW GetCompressedFileSizeW EnumTimeFormatsW GetEnvironmentStrings GetConsoleCP GlobalAlloc LoadLibraryW SetCommConfig TerminateThread GetLocaleInfoW FatalAppExitW IsBadCodePtr DeleteVolumeMountPointW TransactNamedPipe EnumSystemCodePagesA LocalReAlloc CompareStringW GetStartupInfoW SetProcessAffinityMask DisconnectNamedPipe GetShortPathNameA GetPrivateProfileIntW SetCurrentDirectoryA FindFirstFileA GetLastError ChangeTimerQueueTimer SetLastError GetThreadLocale CopyFileA LocalAlloc MoveFileA RemoveDirectoryW SetFileApisToANSI GetOEMCP FindNextFileA GetModuleHandleA GetProcessAffinityMask FatalExit VirtualProtect GetCurrentDirectoryA EnumDateFormatsW PeekConsoleInputA GetShortPathNameW FindFirstVolumeA TerminateJobObject FindAtomW GetWindowsDirectoryW AddConsoleAliasA DebugBreak OpenFileMappingA EnumSystemLocalesW RaiseException GetTempFileNameW GetComputerNameA CreateMailslotW GetCommandLineW GetProcAddress GetModuleHandleW ExitProcess DecodePointer DeleteFileA HeapReAlloc HeapSetInformation UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess GetCurrentProcess EnterCriticalSection LeaveCriticalSection SetFilePointer SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement WriteFile GetModuleFileNameW HeapFree HeapCreate HeapAlloc FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime Sleep SetStdHandle WideCharToMultiByte GetConsoleMode FlushFileBuffers RtlUnwind GetCPInfo GetACP IsValidCodePage MultiByteToWideChar HeapSize IsProcessorFeaturePresent WriteConsoleW LCMapStringW GetStringTypeW ReadFile CloseHandle CreateFileW

user32

CharUpperA

gdi32

GetBoundsRect GetTextFaceW SetBkColor

Sharing