file[.]exe | Triage™

General

Target
file.exe
Size 351KB
Sample230925-nh98jaee41
SHA256 21af47b60bf88124650097f3ccc91ce31df5d23ce452d5458ecf0acaff4bf6df
MD5 bd6ed31aad02918dc9cc88b168e1b9d9
SHA1 cfac29b99494ba249c8dcbdaf5d45bdc25faa862
SHA512 7bb5a91ed79175b372d28894986eb3677bbc6b0569c04208d940e2af8d857d8e700f49007e764754953f01bddddf83d17acd47ab57155e249165a4c6c82009fe
SSDEEP 6144:RSSnSWnP9Mf9EkVtnhjWUwALMaL5x4IPhRiQ12SyUxTYCf2ze5+0ws:sSnrP9gOMhpwu9x42RiniYLze
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 351KB

file.exe

IMPHASH 4ea361ab120c57b8b80c2f6f90919695
SHA256 21af47b60bf88124650097f3ccc91ce31df5d23ce452d5458ecf0acaff4bf6df
MD5 bd6ed31aad02918dc9cc88b168e1b9d9
SHA1 cfac29b99494ba249c8dcbdaf5d45bdc25faa862
SHA512 7bb5a91ed79175b372d28894986eb3677bbc6b0569c04208d940e2af8d857d8e700f49007e764754953f01bddddf83d17acd47ab57155e249165a4c6c82009fe
SSDEEP 6144:RSSnSWnP9Mf9EkVtnhjWUwALMaL5x4IPhRiQ12SyUxTYCf2ze5+0ws:sSnrP9gOMhpwu9x42RiniYLze
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

16502

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetConsoleTextAttribute OpenJobObjectA ReadConsoleA InterlockedDecrement GetSystemWindowsDirectoryW WriteConsoleInputA SetVolumeMountPointW CreateHardLinkA ConnectNamedPipe FreeEnvironmentStringsA GetModuleHandleW GetTickCount GetNumberFormatA GetDateFormatA GetProcessTimes GetThreadSelectorEntry AssignProcessToJobObject SizeofResource HeapCreate TransactNamedPipe GetFileAttributesW GetGeoInfoA CreateFileW FindFirstChangeNotificationW GetLastError SetLastError BackupRead GetProcAddress VirtualAlloc IsValidCodePage OpenWaitableTimerA LoadLibraryA InterlockedExchangeAdd BeginUpdateResourceA FoldStringA FindNextFileW GetShortPathNameW OpenSemaphoreW FindFirstVolumeA ReadConsoleOutputCharacterW FindNextVolumeA LocalFileTimeToFileTime GetProcessHeap SetEndOfFile GetTempFileNameW EnumResourceNamesW GetLogicalDriveStringsA DebugActiveProcess UnhandledExceptionFilter SetUnhandledExceptionFilter HeapFree GetCommandLineA GetStartupInfoA Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA TerminateProcess GetCurrentProcess IsDebuggerPresent HeapAlloc VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc SetHandleCount GetFileType RtlUnwind MultiByteToWideChar ReadFile GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount SetFilePointer GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP CloseHandle CreateFileA SetStdHandle HeapSize GetLocaleInfoA FlushFileBuffers WriteConsoleA GetConsoleOutputCP WriteConsoleW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

user32

GetClassInfoExW LoadMenuW CharToOemBuffW GetMessageExtraInfo

gdi32

GetColorAdjustment

advapi32

InitiateSystemShutdownA

Sharing