file[.]exe | Triage™

General

Target
file.exe
Size 473KB
Sample230924-e9yt5scd2x
SHA256 d788b57c63f3c366d5771b86feb1f0c0a394656feefef3f6f18bda1f8380d4e4
MD5 97f6bcf042f49088a23f18f2eb535574
SHA1 37c12d35bd887509c5b4903a6eafcf7536486f2b
SHA512 ebc2a55e9fd63aaf9b673a8c058e617b6a488548542ead5f50da4994373e3fd1c947404687e6e5dd8f47df85f9fc76ea6c68556fdf42994d273ac95b24b75ec2
SSDEEP 12288:kHTQFlLgNNjMfPPU1ukaAiAOk/n8q2ucr:zjg/GPkMAwr
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 473KB

file.exe

IMPHASH 915313f9baf3d4fbe9e467fb8242a50c
SHA256 d788b57c63f3c366d5771b86feb1f0c0a394656feefef3f6f18bda1f8380d4e4
MD5 97f6bcf042f49088a23f18f2eb535574
SHA1 37c12d35bd887509c5b4903a6eafcf7536486f2b
SHA512 ebc2a55e9fd63aaf9b673a8c058e617b6a488548542ead5f50da4994373e3fd1c947404687e6e5dd8f47df85f9fc76ea6c68556fdf42994d273ac95b24b75ec2
SSDEEP 12288:kHTQFlLgNNjMfPPU1ukaAiAOk/n8q2ucr:zjg/GPkMAwr
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

21693

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindResourceW DeleteVolumeMountPointA EnumCalendarInfoW ReadConsoleA GetCurrentProcess CreateJobObjectW GetEnvironmentStringsW GetModuleHandleExW GetComputerNameW SetCommBreak GetSystemDefaultLCID FreeEnvironmentStringsA GetConsoleAliasesA ReadConsoleW GetWindowsDirectoryA EnumTimeFormatsW GetCommandLineA TzSpecificLocalTimeToSystemTime GetEnvironmentStrings GetConsoleCP GlobalAlloc LoadLibraryW SetCommConfig GetLocaleInfoW IsBadCodePtr DeleteVolumeMountPointW TransactNamedPipe EnumSystemCodePagesA GetTimeFormatW HeapQueryInformation GetCompressedFileSizeA GetDriveTypeW DisconnectNamedPipe GetNamedPipeHandleStateW SetCurrentDirectoryA GetLastError GetCurrentDirectoryW ChangeTimerQueueTimer SetLastError LocalAlloc GetFileType MoveFileA RemoveDirectoryW SetFileApisToANSI FindNextFileA GetModuleHandleA SetLocaleInfoW FatalExit RequestDeviceWakeup CreateMailslotA GetStringTypeW VirtualProtect GetCurrentDirectoryA QueryPerformanceFrequency PeekConsoleInputA GetShortPathNameW FindFirstVolumeA TerminateJobObject FindAtomW AddConsoleAliasA OpenFileMappingA EnumSystemLocalesW CreateFileW GetConsoleAliasExesA GetConsoleAliasesLengthW SetDefaultCommConfigA WriteConsoleInputW GetStartupInfoW GetTempFileNameW DeleteFileA HeapReAlloc GetProcAddress GetModuleHandleW ExitProcess DecodePointer GetCommandLineW HeapSetInformation RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess HeapAlloc HeapFree IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection HeapCreate SetFilePointer InitializeCriticalSectionAndSpinCount DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement WriteFile GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW SetHandleCount QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime Sleep RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage MultiByteToWideChar WideCharToMultiByte SetStdHandle GetConsoleMode FlushFileBuffers HeapSize LCMapStringW ReadFile WriteConsoleW CloseHandle

user32

CharUpperW

gdi32

GetTextFaceA GetCharWidthA SetBkColor

advapi32

ReadEventLogA

Sharing