file[.]exe | Triage™

General

Target
file.exe
Size 199KB
Sample230925-m59d3sed81
SHA256 2970f93fdff86b1cfdce4bee35650f58bb2c8face78c7e9228ad6c697d3d5b40
MD5 7d8f813ca4681dd17aec22a2cfdd5858
SHA1 dc5409b772f67a7d31a2b8f0c11ad867229c54af
SHA512 ec23c3d4312ba7b2cd77bfa75fcf78bd2e03e20227170669c0c24cc3b7a3210832c393b87abc9c92cb570c24c5069e2ec1b062127ea2a7b370e4e881b8bb75db
SSDEEP 3072:g6UEth9wVHT9u1dMsZzqCcKJ/ofabM7vk+dQ5CnYT:ggth9wfu1lZzqhYofEA1l
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 199KB

file.exe

IMPHASH 4ea361ab120c57b8b80c2f6f90919695
SHA256 2970f93fdff86b1cfdce4bee35650f58bb2c8face78c7e9228ad6c697d3d5b40
MD5 7d8f813ca4681dd17aec22a2cfdd5858
SHA1 dc5409b772f67a7d31a2b8f0c11ad867229c54af
SHA512 ec23c3d4312ba7b2cd77bfa75fcf78bd2e03e20227170669c0c24cc3b7a3210832c393b87abc9c92cb570c24c5069e2ec1b062127ea2a7b370e4e881b8bb75db
SSDEEP 3072:g6UEth9wVHT9u1dMsZzqCcKJ/ofabM7vk+dQ5CnYT:ggth9wfu1lZzqhYofEA1l
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

16502

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetConsoleTextAttribute OpenJobObjectA ReadConsoleA InterlockedDecrement GetSystemWindowsDirectoryW WriteConsoleInputA SetVolumeMountPointW CreateHardLinkA ConnectNamedPipe FreeEnvironmentStringsA GetModuleHandleW GetTickCount GetNumberFormatA GetDateFormatA GetProcessTimes GetThreadSelectorEntry AssignProcessToJobObject SizeofResource HeapCreate TransactNamedPipe GetFileAttributesW GetGeoInfoA CreateFileW FindFirstChangeNotificationW GetLastError SetLastError BackupRead GetProcAddress VirtualAlloc IsValidCodePage OpenWaitableTimerA LoadLibraryA InterlockedExchangeAdd BeginUpdateResourceA FoldStringA FindNextFileW GetShortPathNameW OpenSemaphoreW FindFirstVolumeA ReadConsoleOutputCharacterW FindNextVolumeA LocalFileTimeToFileTime GetProcessHeap SetEndOfFile GetTempFileNameW EnumResourceNamesW GetLogicalDriveStringsA DebugActiveProcess UnhandledExceptionFilter SetUnhandledExceptionFilter HeapFree GetCommandLineA GetStartupInfoA Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA TerminateProcess GetCurrentProcess IsDebuggerPresent HeapAlloc VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc SetHandleCount GetFileType RtlUnwind MultiByteToWideChar ReadFile GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount SetFilePointer GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP CloseHandle CreateFileA SetStdHandle HeapSize GetLocaleInfoA FlushFileBuffers WriteConsoleA GetConsoleOutputCP WriteConsoleW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

user32

GetClassInfoExW LoadMenuW CharToOemBuffW GetMessageExtraInfo

gdi32

GetColorAdjustment

advapi32

InitiateSystemShutdownA

Sharing