file[.]exe | Triage™

General

Target
file.exe
Size 267KB
Sample230927-qqnqlscc63
SHA256 8d563a1972dc04359f7b2c710012276e85aebae7ef3919c513698d188150bdd3
MD5 215972a4c118e9cf450fc9cbc00fba7a
SHA1 03411fe2582c1123e7cd45cd81e2d1eb924bfa5c
SHA512 f8b4ee56c11dd70c051aa007f6e1f2e686a1ca9cfd9403552c0eeff23e65fafd5b8168a2750d6fff07ca39bea2a61585bb552179ea695bc569b3553cc5479853
SSDEEP 6144:wOUvZxzK+Qed1OukRXPhjcjuFV9FRMxNT4:xIxzq48uw+juFzu54
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 267KB

file.exe

IMPHASH c979a88e8595d029726dd8a9185ca5bc
SHA256 8d563a1972dc04359f7b2c710012276e85aebae7ef3919c513698d188150bdd3
MD5 215972a4c118e9cf450fc9cbc00fba7a
SHA1 03411fe2582c1123e7cd45cd81e2d1eb924bfa5c
SHA512 f8b4ee56c11dd70c051aa007f6e1f2e686a1ca9cfd9403552c0eeff23e65fafd5b8168a2750d6fff07ca39bea2a61585bb552179ea695bc569b3553cc5479853
SSDEEP 6144:wOUvZxzK+Qed1OukRXPhjcjuFV9FRMxNT4:xIxzq48uw+juFzu54
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

20769

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLogicalDriveStringsW GetSystemWindowsDirectoryW FreeEnvironmentStringsA GetModuleHandleW GetTickCount GetNumberFormatA ReadConsoleW GetGeoInfoW GetDateFormatA ReadConsoleInputA GetThreadSelectorEntry AssignProcessToJobObject SizeofResource SetVolumeMountPointA GetProcessHandleCount HeapCreate TransactNamedPipe GetFileAttributesW IsDBCSLeadByte CreateFileW GetACP GetLastError SetLastError GetProcAddress VirtualAlloc BackupWrite InterlockedDecrement LoadLibraryA InterlockedExchangeAdd OpenWaitableTimerW WritePrivateProfileStringA CreateHardLinkW AddAtomW BeginUpdateResourceA SetConsoleWindowInfo GetCommMask OpenJobObjectW FoldStringW CreatePipe FindNextFileA GetShortPathNameW OpenSemaphoreW FindFirstVolumeA FindFirstVolumeW ReadConsoleOutputCharacterW LocalFileTimeToFileTime GetProcessHeap SetEndOfFile VirtualQuery EnumResourceNamesW GetTempFileNameA DebugActiveProcess UnhandledExceptionFilter SetUnhandledExceptionFilter HeapFree Sleep ExitProcess GetCommandLineA GetStartupInfoA WriteFile GetStdHandle GetModuleFileNameA TerminateProcess GetCurrentProcess IsDebuggerPresent HeapAlloc RaiseException VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc SetHandleCount GetFileType TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId HeapSize RtlUnwind MultiByteToWideChar ReadFile InitializeCriticalSectionAndSpinCount GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetModuleHandleA SetFilePointer GetConsoleCP GetConsoleMode GetCPInfo GetOEMCP IsValidCodePage CloseHandle CreateFileA SetStdHandle GetLocaleInfoA FlushFileBuffers WriteConsoleA GetConsoleOutputCP WriteConsoleW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

user32

ChangeDisplaySettingsW LoadMenuA GetClassInfoExW GetScrollInfo CharToOemBuffW GetMessageExtraInfo

gdi32

SetColorAdjustment

advapi32

InitiateSystemShutdownA SetKernelObjectSecurity

Sharing