file[.]exe | Triage™

General

Target
file.exe
Size 308KB
Sample230926-rezjeabc53
SHA256 b2aa1408b77d5272d0e9f7250e196124fd2cc5d86f8ef90abe0ec37ea27b41af
MD5 07e1135280b0856cbf74d013e5aed90e
SHA1 3a9fbc8d91356e610f02ef5998df998f972a70db
SHA512 fdc735c387affcd3a2ecb3d1d58fc43dfd7cfcb9ae25928a279737bf73a5de5d678bc411843a3cd65608bcacebd166321360511d961ec25e18e727b52a9e28f4
SSDEEP 3072:SDdLb8Lyom0PXxdwglElsoFBq7JvlbCKQw0G9jSa3p10IUxwVapbOU:6Lb8LdmkhdwgKPiVvJQw0GlSI2tpK
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 308KB

file.exe

IMPHASH 3a2cfd451f63c964ba41b70cb789f61b
SHA256 b2aa1408b77d5272d0e9f7250e196124fd2cc5d86f8ef90abe0ec37ea27b41af
MD5 07e1135280b0856cbf74d013e5aed90e
SHA1 3a9fbc8d91356e610f02ef5998df998f972a70db
SHA512 fdc735c387affcd3a2ecb3d1d58fc43dfd7cfcb9ae25928a279737bf73a5de5d678bc411843a3cd65608bcacebd166321360511d961ec25e18e727b52a9e28f4
SSDEEP 3072:SDdLb8Lyom0PXxdwglElsoFBq7JvlbCKQw0G9jSa3p10IUxwVapbOU:6Lb8LdmkhdwgKPiVvJQw0GlSI2tpK
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

23177

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

EnumCalendarInfoW ReadConsoleA SetDefaultCommConfigW GetEnvironmentStringsW GetModuleHandleExW WriteConsoleInputA AddConsoleAliasW GetComputerNameW CreateHardLinkA GetConsoleAliasesA GetConsoleAliasesLengthA ReadConsoleW GetCompressedFileSizeW GetConsoleAliasExesW EnumTimeFormatsA TzSpecificLocalTimeToSystemTime GetEnvironmentStrings GetConsoleCP GlobalAlloc LoadLibraryW InterlockedPopEntrySList TransactNamedPipe GetFileAttributesW HeapQueryInformation CompareStringW MultiByteToWideChar GetStartupInfoW CreateMailslotW DisconnectNamedPipe GetShortPathNameA DeleteVolumeMountPointA GetLastError GetCurrentDirectoryW SetLastError WriteProfileSectionA RemoveDirectoryA EnumSystemCodePagesW SetComputerNameA GetTempFileNameA MoveFileA CreateHardLinkW FindAtomA GetModuleHandleA SetLocaleInfoW OpenFileMappingW FreeEnvironmentStringsW FindNextFileW RequestDeviceWakeup GetStringTypeW VirtualProtect PurgeComm QueryPerformanceFrequency PeekConsoleInputA GetShortPathNameW SetCalendarInfoA FindFirstVolumeA GetWindowsDirectoryW GetVolumeNameForVolumeMountPointW GetCurrentProcessId SwitchToThread CreateFileW FindResourceW GetDriveTypeW OpenFile GetLocaleInfoA GetNamedPipeHandleStateW GetCommandLineW GetProcAddress GetModuleHandleW ExitProcess DecodePointer DeleteFileA HeapReAlloc HeapSetInformation RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess GetCurrentProcess HeapAlloc HeapFree IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement WriteFile GetStdHandle GetModuleFileNameW HeapCreate SetFilePointer SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime Sleep RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage WideCharToMultiByte HeapSize SetStdHandle GetConsoleMode FlushFileBuffers LCMapStringW ReadFile WriteConsoleW CloseHandle

user32

CharUpperA

gdi32

GetKerningPairsA GetCharWidthA SetBkColor

advapi32

ReadEventLogW

Sharing