file[.]exe | Triage™

General

Target
file.exe
Size 192KB
Sample231002-lrl6ysad64
SHA256 57688af73943e8a11d4e4ebc1fcb3c36391e974d4c8cd1effae9b86dc336eefd
MD5 1bf68d0e7557c2f65b776f26a526ce9d
SHA1 67b5d053b1dd8a3c5a4eeff20a0e1717d81169cd
SHA512 777c24260a63f566d68c8651918f4c12014f7d258d2db2eff063d77d2550eaf383e91b01b33a99031620acac8ba609be9eacbd8fca2c7311ff897cf10929b930
SSDEEP 3072:ckdqfVIHh3p9B743c/0i5L+lnYbQfY88LcO5oH2fovV:sIB3SMzl+6kQ88i2QV
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 192KB

file.exe

IMPHASH 7af6f3315c82464c60fc734ddad5dae4
SHA256 57688af73943e8a11d4e4ebc1fcb3c36391e974d4c8cd1effae9b86dc336eefd
MD5 1bf68d0e7557c2f65b776f26a526ce9d
SHA1 67b5d053b1dd8a3c5a4eeff20a0e1717d81169cd
SHA512 777c24260a63f566d68c8651918f4c12014f7d258d2db2eff063d77d2550eaf383e91b01b33a99031620acac8ba609be9eacbd8fca2c7311ff897cf10929b930
SSDEEP 3072:ckdqfVIHh3p9B743c/0i5L+lnYbQfY88LcO5oH2fovV:sIB3SMzl+6kQ88i2QV
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

16828

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetDateFormatW RemoveVectoredExceptionHandler GetCPInfo EndUpdateResourceW OpenJobObjectA ReadConsoleA InterlockedCompareExchange AddConsoleAliasW CreateHardLinkA MoveFileWithProgressA GetTickCount GetNumberFormatA GetWindowsDirectoryA GlobalFindAtomA LoadLibraryW ReadConsoleInputA SizeofResource SetVolumeMountPointA TransactNamedPipe FindNextVolumeW CreateSemaphoreA GetFileAttributesW WritePrivateProfileSectionW FileTimeToSystemTime GetLastError SetLastError GetProcAddress DebugActiveProcess BeginUpdateResourceW SetVolumeLabelW EnumSystemCodePagesW LoadLibraryA OpenWaitableTimerW GetFileType GetExitCodeThread AddAtomW RemoveDirectoryW GetCommMask FoldStringA FindNextFileA OpenFileMappingW FreeEnvironmentStringsW EnumResourceNamesA GetWindowsDirectoryW ReadConsoleOutputCharacterW LocalFree GetVolumeInformationW CreateFileA CloseHandle WriteConsoleW GetConsoleOutputCP VirtualAlloc WriteConsoleA UnhandledExceptionFilter SetUnhandledExceptionFilter GetCommandLineA GetStartupInfoA GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA RaiseException HeapAlloc TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement HeapSize EnterCriticalSection LeaveCriticalSection TerminateProcess GetCurrentProcess IsDebuggerPresent MultiByteToWideChar ReadFile SetHandleCount DeleteCriticalSection SetFilePointer FreeEnvironmentStringsA GetEnvironmentStrings WideCharToMultiByte GetEnvironmentStringsW HeapCreate VirtualFree HeapFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount GetModuleHandleA HeapReAlloc GetACP GetOEMCP IsValidCodePage RtlUnwind SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers GetLocaleInfoA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

user32

GetMessagePos GetWindowTextLengthA LoadMenuW CreateWindowStationA CharToOemBuffW ChangeDisplaySettingsA

advapi32

InitiateSystemShutdownA

ole32

CoMarshalHresult

Sharing