file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 347KB
Sample231001-rey8msch69
SHA256 ca0faf739b92b535bc7d0eb79698d073bcff55a9fe659839f11a1355de21bb7c
MD5 ff6ab4a9c61bfa4bd33ce0be52758133
SHA1 5cf4a178b32032a5185dd4e3767abbc1e924d0cc
SHA512 c098a1e77caffc4be6c3419b3d193c44e34cb30d22eb4f88d75aef572fa108d77bf4065d2f301e3e81ad3633695f936c633cf3bb6bb0e758d330243071c327a3
SSDEEP 6144:Ywx+2+Rh4c6Uz6ezSDwJlhuM8g1AygZae6JaQDN:Ywx7wOaeXDwJEePpHhh
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 347KB

file.exe

IMPHASH 93d103d7b72d447eca6f713c27a7a3a5
SHA256 ca0faf739b92b535bc7d0eb79698d073bcff55a9fe659839f11a1355de21bb7c
MD5 ff6ab4a9c61bfa4bd33ce0be52758133
SHA1 5cf4a178b32032a5185dd4e3767abbc1e924d0cc
SHA512 c098a1e77caffc4be6c3419b3d193c44e34cb30d22eb4f88d75aef572fa108d77bf4065d2f301e3e81ad3633695f936c633cf3bb6bb0e758d330243071c327a3
SSDEEP 6144:Ywx+2+Rh4c6Uz6ezSDwJlhuM8g1AygZae6JaQDN:Ywx7wOaeXDwJEePpHhh
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCPInfo EndUpdateResourceW SetConsoleTextAttribute OpenJobObjectA InterlockedCompareExchange CreateHardLinkA GetTickCount VirtualFree GenerateConsoleCtrlEvent GetNumberFormatA ReadConsoleW GetWindowsDirectoryA GetVolumeInformationA GlobalFindAtomA SizeofResource SetVolumeMountPointA TransactNamedPipe CreateSemaphoreA GetFileAttributesW WritePrivateProfileSectionW FileTimeToSystemTime WritePrivateProfileStringW GetLastError GetProcAddress EnumResourceNamesW SetVolumeLabelW LoadLibraryA OpenWaitableTimerW GetFileType RemoveDirectoryW BeginUpdateResourceA GetCommMask AddAtomA FoldStringA FindNextFileA FreeEnvironmentStringsW GetShortPathNameW ReadConsoleInputW GetWindowsDirectoryW ReadConsoleOutputCharacterW OpenFileMappingA FindNextVolumeA TlsFree CreateFileA CloseHandle WriteConsoleW GetConsoleOutputCP DebugActiveProcess GetDateFormatW VirtualAlloc WriteConsoleA UnhandledExceptionFilter SetUnhandledExceptionFilter GetCommandLineA GetStartupInfoA GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA TerminateProcess GetCurrentProcess IsDebuggerPresent HeapAlloc HeapFree RaiseException TlsGetValue TlsAlloc TlsSetValue InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapSize EnterCriticalSection LeaveCriticalSection SetHandleCount DeleteCriticalSection SetFilePointer FreeEnvironmentStringsA GetEnvironmentStrings WideCharToMultiByte GetEnvironmentStringsW HeapCreate QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount HeapReAlloc GetModuleHandleA GetACP GetOEMCP IsValidCodePage RtlUnwind SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers GetLocaleInfoA LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW

user32

GetMessagePos ChangeDisplaySettingsW CreateWindowStationW GetWindowTextLengthA LoadMenuW CharToOemBuffW

gdi32

GetCharacterPlacementA

advapi32

InitiateSystemShutdownW

ole32

CoMarshalHresult