file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 194KB
Sample231001-bc75rshf83
SHA256 b33e145fbed8a2aa63bf595a8bdd2c06166ea57a7added593c598ab2c63014a6
MD5 698d59936866d3682052cf37f4e11a83
SHA1 c0b9586035fe1a8596de8b8f5b8048d8e0f98455
SHA512 e6149048816f8c8d10c56a33ed7d76324a13096c3e15da45d4dcb0e78aff05f7591842285e7e640e645c61b5746d38810117794e934c1c9914bf15266a5bec5e
SSDEEP 3072:6vcRkKJ5yRr2hsLy7Nzz9WQO2fsGckO7xgwl+S5/fb3:9JcRAgyRsV2DckOO2
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 194KB

file.exe

IMPHASH eb89aa3fcf43b156dad667e281a2675a
SHA256 b33e145fbed8a2aa63bf595a8bdd2c06166ea57a7added593c598ab2c63014a6
MD5 698d59936866d3682052cf37f4e11a83
SHA1 c0b9586035fe1a8596de8b8f5b8048d8e0f98455
SHA512 e6149048816f8c8d10c56a33ed7d76324a13096c3e15da45d4dcb0e78aff05f7591842285e7e640e645c61b5746d38810117794e934c1c9914bf15266a5bec5e
SSDEEP 3072:6vcRkKJ5yRr2hsLy7Nzz9WQO2fsGckO7xgwl+S5/fb3:9JcRAgyRsV2DckOO2
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17872

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

EndUpdateResourceW SetConsoleTextAttribute OpenJobObjectA InterlockedCompareExchange SetVolumeMountPointW FreeEnvironmentStringsA GetTickCount GetNumberFormatA ReadConsoleW GetWindowsDirectoryA GetDateFormatA ReadConsoleInputA GetThreadSelectorEntry SizeofResource HeapDestroy GetFileAttributesA TransactNamedPipe WritePrivateProfileSectionW FileTimeToSystemTime GetGeoInfoA IsDBCSLeadByte WritePrivateProfileStringW GetLastError GetProcAddress VirtualAlloc GetCPInfo LoadLibraryA CreateSemaphoreW OpenWaitableTimerW CreateHardLinkW RemoveDirectoryW BeginUpdateResourceA GetCommMask AddAtomA FoldStringA FindNextFileA OpenFileMappingW EnumResourceNamesA GetShortPathNameW GetWindowsDirectoryW FindFirstVolumeW ReadConsoleOutputCharacterW FindNextVolumeA CreateFileA CloseHandle WriteConsoleW GetConsoleOutputCP SetProcessAffinityMask SetVolumeLabelW DebugActiveProcess WriteConsoleA UnhandledExceptionFilter SetUnhandledExceptionFilter GetCommandLineA GetStartupInfoA GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA TerminateProcess GetCurrentProcess IsDebuggerPresent HeapAlloc HeapFree RaiseException TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapSize EnterCriticalSection LeaveCriticalSection SetHandleCount GetFileType DeleteCriticalSection SetFilePointer GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount HeapReAlloc GetModuleHandleA GetACP GetOEMCP IsValidCodePage RtlUnwind SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers GetLocaleInfoA LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW

user32

GetMessagePos GetWindowTextLengthA LoadMenuW CreateWindowStationA CharToOemBuffW ChangeDisplaySettingsA

gdi32

GetCharacterPlacementA

advapi32

InitiateSystemShutdownW

ole32

ReadClassStg