file[.]exe | Triage™

General

Target
file.exe
Size 396KB
Sample230929-mfylaaba99
SHA256 f78f9e0ce0ede55d7fc162bf631069d6afd9ff28b425bb6a84be62ce7f8ef9aa
MD5 8eb5c1c80671e260eeba3ed25998ad1c
SHA1 21d210818a40f13cf1022a31f8db87b0deaba53b
SHA512 1e1016983168d1f5dcb051ffcc05a61fb51424a2a745fb96eb2cd11602b40ce87786c801d5dd5eda46ced9c9de164ce845e50b4eb85f6df128d03bb2eea37965
SSDEEP 6144:fy4ZdBYXFRL6ZJedPu6gyoOZ451lBbn8TZ1RDLeuJgzdApDhTc1o:f/PYXFigM6gyoOZoqTZ19FJg+DFwo
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 396KB

file.exe

IMPHASH 2a568f33595a0107732fea57be00f8ed
SHA256 f78f9e0ce0ede55d7fc162bf631069d6afd9ff28b425bb6a84be62ce7f8ef9aa
MD5 8eb5c1c80671e260eeba3ed25998ad1c
SHA1 21d210818a40f13cf1022a31f8db87b0deaba53b
SHA512 1e1016983168d1f5dcb051ffcc05a61fb51424a2a745fb96eb2cd11602b40ce87786c801d5dd5eda46ced9c9de164ce845e50b4eb85f6df128d03bb2eea37965
SSDEEP 6144:fy4ZdBYXFRL6ZJedPu6gyoOZ451lBbn8TZ1RDLeuJgzdApDhTc1o:f/PYXFigM6gyoOZoqTZ19FJg+DFwo
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

27934

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempFileNameW SetProcessAffinityMask VirtualQuery InterlockedDecrement InterlockedCompareExchange OpenSemaphoreA FreeEnvironmentStringsA GetTickCount GetNumberFormatA ReadConsoleW GetGeoInfoW GetDateFormatA GetThreadSelectorEntry AssignProcessToJobObject SizeofResource SetVolumeMountPointA GetSystemWindowsDirectoryA HeapDestroy GetFileAttributesA TransactNamedPipe IsDBCSLeadByte GetACP WritePrivateProfileStringW GetShortPathNameA GetLastError SetLastError GetProcAddress GetFullPathNameA BeginUpdateResourceW BackupWrite OpenWaitableTimerA LoadLibraryA CreateHardLinkW SetConsoleWindowInfo GetCommMask AddAtomA OpenJobObjectW FoldStringW CreatePipe FindNextFileA OpenFileMappingW EnumResourceNamesA EndUpdateResourceA ReadConsoleInputW FindFirstVolumeW ReadConsoleOutputCharacterW FindNextVolumeA LocalFileTimeToFileTime ReadFile GetProcessHeap SetEndOfFile VirtualAlloc DebugActiveProcess UnhandledExceptionFilter SetUnhandledExceptionFilter HeapFree HeapAlloc GetModuleHandleW Sleep ExitProcess GetCommandLineA GetStartupInfoA WriteFile GetStdHandle GetModuleFileNameA TerminateProcess GetCurrentProcess IsDebuggerPresent RaiseException HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc SetHandleCount GetFileType TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId HeapSize RtlUnwind SetFilePointer InitializeCriticalSectionAndSpinCount GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetModuleHandleA GetConsoleCP GetConsoleMode GetCPInfo GetOEMCP IsValidCodePage CloseHandle CreateFileA SetStdHandle FlushFileBuffers GetLocaleInfoA WriteConsoleA GetConsoleOutputCP WriteConsoleW MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

user32

GetMessageExtraInfo LoadMenuA GetScrollInfo CharToOemBuffW ChangeDisplaySettingsA GetClassInfoExA

advapi32

InitiateSystemShutdownA

Sharing