file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 234KB
Sample230930-2h8llahc52
SHA256 421f7e7128482d501fc4c7d44748061d9572f8a1b053bd07cb5fe16e9dcc4428
MD5 957d853736cd6c27ab3fa4ed491d1a96
SHA1 db355f36fcda0a3fec9308bd532fc706b80deebe
SHA512 7ef0d32fa8416197c692c8c73d160f6348bd543e947a172be786faf5beb587c139849cc951a16d44b44589ce2a19bca3da4ad5bc61553ad88068494911fa81eb
SSDEEP 3072:53kEZR5xvQU2uQ/bY8YYlf63NX4OqS5/k16ATO3:5xverUf3KO5dAT
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 234KB

file.exe

IMPHASH eb89aa3fcf43b156dad667e281a2675a
SHA256 421f7e7128482d501fc4c7d44748061d9572f8a1b053bd07cb5fe16e9dcc4428
MD5 957d853736cd6c27ab3fa4ed491d1a96
SHA1 db355f36fcda0a3fec9308bd532fc706b80deebe
SHA512 7ef0d32fa8416197c692c8c73d160f6348bd543e947a172be786faf5beb587c139849cc951a16d44b44589ce2a19bca3da4ad5bc61553ad88068494911fa81eb
SSDEEP 3072:53kEZR5xvQU2uQ/bY8YYlf63NX4OqS5/k16ATO3:5xverUf3KO5dAT
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17872

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

EndUpdateResourceW SetConsoleTextAttribute OpenJobObjectA InterlockedCompareExchange SetVolumeMountPointW FreeEnvironmentStringsA GetTickCount GetNumberFormatA ReadConsoleW GetWindowsDirectoryA GetDateFormatA ReadConsoleInputA GetThreadSelectorEntry SizeofResource HeapDestroy GetFileAttributesA TransactNamedPipe WritePrivateProfileSectionW FileTimeToSystemTime GetGeoInfoA IsDBCSLeadByte WritePrivateProfileStringW GetLastError GetProcAddress VirtualAlloc GetCPInfo LoadLibraryA CreateSemaphoreW OpenWaitableTimerW CreateHardLinkW RemoveDirectoryW BeginUpdateResourceA GetCommMask AddAtomA FoldStringA FindNextFileA OpenFileMappingW EnumResourceNamesA GetShortPathNameW GetWindowsDirectoryW FindFirstVolumeW ReadConsoleOutputCharacterW FindNextVolumeA CreateFileA CloseHandle WriteConsoleW GetConsoleOutputCP SetProcessAffinityMask SetVolumeLabelW DebugActiveProcess WriteConsoleA UnhandledExceptionFilter SetUnhandledExceptionFilter GetCommandLineA GetStartupInfoA GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA TerminateProcess GetCurrentProcess IsDebuggerPresent HeapAlloc HeapFree RaiseException TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapSize EnterCriticalSection LeaveCriticalSection SetHandleCount GetFileType DeleteCriticalSection SetFilePointer GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount HeapReAlloc GetModuleHandleA GetACP GetOEMCP IsValidCodePage RtlUnwind SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers GetLocaleInfoA LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW

user32

GetMessagePos GetWindowTextLengthA LoadMenuW CreateWindowStationA CharToOemBuffW ChangeDisplaySettingsA

gdi32

GetCharacterPlacementA

advapi32

InitiateSystemShutdownW

ole32

ReadClassStg