file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 239KB
Sample230930-ryj8tsef29
SHA256 d055a2cfcc1c1c0399fbfd53b30b21083aed57ec6677f3fd4db61ebf01561356
MD5 195e87075a7924b2e8b6cc880c05b28e
SHA1 04e998ce99a1498b205245918c891fd553dbbb75
SHA512 c8a8f541670d6ea5f566097dbc376a10443b39d6ae72367c80711016a09810e3d8652e54c5b0f76993302256f0ef8c57e41d47bf9e95414f8dbe4886ea8f5347
SSDEEP 3072:iXjliYBn8cXICsADr2w5m7TfXKBjINDmOMhTd/kPgRSHY6p5V40J:ifxXI5WKwyfXKBszqhgDL4
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 239KB

file.exe

IMPHASH 5a388ef2cf242f40b496c828593b517b
SHA256 d055a2cfcc1c1c0399fbfd53b30b21083aed57ec6677f3fd4db61ebf01561356
MD5 195e87075a7924b2e8b6cc880c05b28e
SHA1 04e998ce99a1498b205245918c891fd553dbbb75
SHA512 c8a8f541670d6ea5f566097dbc376a10443b39d6ae72367c80711016a09810e3d8652e54c5b0f76993302256f0ef8c57e41d47bf9e95414f8dbe4886ea8f5347
SSDEEP 3072:iXjliYBn8cXICsADr2w5m7TfXKBjINDmOMhTd/kPgRSHY6p5V40J:ifxXI5WKwyfXKBszqhgDL4
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27157

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCPInfo EndUpdateResourceW SetConsoleTextAttribute OpenJobObjectA ReadConsoleA InterlockedCompareExchange SetVolumeMountPointW CreateHardLinkA FreeEnvironmentStringsA GetTickCount GetNumberFormatA GetWindowsDirectoryA ReadConsoleInputA GetThreadSelectorEntry SizeofResource HeapDestroy GetFileAttributesA TransactNamedPipe FileTimeToSystemTime GetGeoInfoA IsDBCSLeadByte WritePrivateProfileStringW GetShortPathNameA GetLastError GetProcAddress OpenWaitableTimerA LoadLibraryA CreateSemaphoreW RemoveDirectoryW BeginUpdateResourceA GetCommMask AddAtomA FoldStringW CreatePipe FindNextFileA OpenFileMappingW EnumResourceNamesA VirtualProtect GetWindowsDirectoryW FindFirstVolumeW ReadConsoleOutputCharacterW FindNextVolumeA WriteConsoleW GetConsoleOutputCP WriteConsoleA ReadFile GetDateFormatW SetProcessAffinityMask VirtualAlloc DebugActiveProcess GetProcessHeap SetEndOfFile UnhandledExceptionFilter SetUnhandledExceptionFilter GetCommandLineA GetStartupInfoA GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA TerminateProcess GetCurrentProcess IsDebuggerPresent HeapAlloc HeapFree RaiseException TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapSize EnterCriticalSection LeaveCriticalSection RtlUnwind SetHandleCount GetFileType DeleteCriticalSection SetFilePointer GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount HeapReAlloc GetModuleHandleA GetACP GetOEMCP IsValidCodePage CloseHandle CreateFileA SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers GetLocaleInfoA LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW

user32

CharToOemBuffW GetClassInfoExA GetMessageExtraInfo ChangeDisplaySettingsW LoadMenuA GetScrollInfo

gdi32

GetCharacterPlacementA

advapi32

InitiateSystemShutdownW

ole32

ReadClassStg