client[.]exe | Triage™

General

Target
client.exe
Size 243KB
Sample230927-m849jaac6t
SHA256 0593d290e0110f628cd3922e52e1997354d1eaaf40f2ab192c5d12c811f5ba53
MD5 8fc19309b5cea833bcd32517aef20e6c
SHA1 6e2e8cab3c4dfe75f99d12cf9cff7fd9ce322a34
SHA512 34033761eb90f87e48a9edfd93819f3e1bffeb9a32f6504c76dc70de78521f6ff57b4ad1121d7eb9149df0d30d10db653fcde8ae7d94340a488682c8f0f314ff
SSDEEP 3072:5W1+KQuqZdPACX/VIlBuPMVEOqFo67UFMQBzttxq8i7u5s5cPSPTrbp:52c9Z5AOVAEPUEOq5UqCwyP0TJ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
client.exe

File Explorer

client.exe

.exe 243KB

client.exe

IMPHASH c2a83ca8344e84c2d8651b169323028d
SHA256 0593d290e0110f628cd3922e52e1997354d1eaaf40f2ab192c5d12c811f5ba53
MD5 8fc19309b5cea833bcd32517aef20e6c
SHA1 6e2e8cab3c4dfe75f99d12cf9cff7fd9ce322a34
SHA512 34033761eb90f87e48a9edfd93819f3e1bffeb9a32f6504c76dc70de78521f6ff57b4ad1121d7eb9149df0d30d10db653fcde8ae7d94340a488682c8f0f314ff
SSDEEP 3072:5W1+KQuqZdPACX/VIlBuPMVEOqFo67UFMQBzttxq8i7u5s5cPSPTrbp:52c9Z5AOVAEPUEOq5UqCwyP0TJ
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

20433

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLogicalDriveStringsW GetSystemWindowsDirectoryW WriteConsoleInputA OpenSemaphoreA FreeEnvironmentStringsA GetModuleHandleW GetTickCount GetNumberFormatA ReadConsoleW GetGeoInfoW GetDateFormatA GetThreadSelectorEntry AssignProcessToJobObject SizeofResource SetVolumeMountPointA GetProcessHandleCount HeapCreate TransactNamedPipe FindNextVolumeW GetFileAttributesW IsDBCSLeadByte CreateFileW GetACP GetLastError SetLastError BackupRead InterlockedDecrement VirtualAlloc GetTempFileNameA LoadLibraryA InterlockedExchangeAdd OpenWaitableTimerW WritePrivateProfileStringA CreateHardLinkW AddAtomW BeginUpdateResourceA SetConsoleWindowInfo GetCommMask OpenJobObjectW FoldStringW CreatePipe FindNextFileA GetShortPathNameW FindFirstVolumeA ReadConsoleOutputCharacterW LocalFileTimeToFileTime GetProcessHeap SetEndOfFile VirtualQuery EnumResourceNamesW GetProcAddress DebugActiveProcess HeapFree Sleep ExitProcess GetCommandLineA GetStartupInfoA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc RaiseException VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc SetHandleCount GetStdHandle GetFileType TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId HeapSize RtlUnwind MultiByteToWideChar ReadFile WriteFile GetModuleFileNameA InitializeCriticalSectionAndSpinCount GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetModuleHandleA SetFilePointer GetConsoleCP GetConsoleMode GetCPInfo GetOEMCP IsValidCodePage CloseHandle CreateFileA SetStdHandle GetLocaleInfoA FlushFileBuffers WriteConsoleA GetConsoleOutputCP WriteConsoleW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

user32

ChangeDisplaySettingsW LoadMenuA GetClassInfoExW GetScrollInfo CharToOemBuffW GetMessageExtraInfo

gdi32

SetColorAdjustment

advapi32

InitiateSystemShutdownA SetKernelObjectSecurity

Sharing