file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 234KB
Sample231002-mbc4saaf33
SHA256 d4b60a5225dd6edc3d0fc961e00cd88b9f8afe777655e1da1ad0435a0ce40be6
MD5 e317c90fdb7cd5d84fd52798ac6bbfc2
SHA1 9c05b3fffefea5dc118967658875aee167cba927
SHA512 5d09ea086b5bddde434738f9f4f5661f6e3ad6f8bf51835655f931d64ca3a8b903de775134ba7e8d703898559a038d426a9eaf89e18889c46bcd353529820b9c
SSDEEP 3072:RL3AHN0I8yBbxN2hr+y2tuql8eqlfKXq956pY6Jp2fovVe:Z34N5NBNchr+LqjKZpY6Jp2QV
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 234KB

file.exe

IMPHASH 5d35fce13cfe2b1d2850575b7eeb2ceb
SHA256 d4b60a5225dd6edc3d0fc961e00cd88b9f8afe777655e1da1ad0435a0ce40be6
MD5 e317c90fdb7cd5d84fd52798ac6bbfc2
SHA1 9c05b3fffefea5dc118967658875aee167cba927
SHA512 5d09ea086b5bddde434738f9f4f5661f6e3ad6f8bf51835655f931d64ca3a8b903de775134ba7e8d703898559a038d426a9eaf89e18889c46bcd353529820b9c
SSDEEP 3072:RL3AHN0I8yBbxN2hr+y2tuql8eqlfKXq956pY6Jp2fovVe:Z34N5NBNchr+LqjKZpY6Jp2QV
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18476

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

RemoveVectoredExceptionHandler GetCPInfo EndUpdateResourceW OpenJobObjectA ReadConsoleA InterlockedCompareExchange AddConsoleAliasW CreateHardLinkA MoveFileWithProgressA GetTickCount GetNumberFormatA GetWindowsDirectoryA GlobalFindAtomA LoadLibraryW TerminateThread ReadConsoleInputA SizeofResource SetVolumeMountPointA GetFileAttributesA TransactNamedPipe FindNextVolumeW CreateSemaphoreA WritePrivateProfileSectionW FileTimeToSystemTime GetLastError SetLastError GetProcAddress SetVolumeLabelA BeginUpdateResourceW EnumSystemCodePagesW OpenWaitableTimerA LoadLibraryA InterlockedExchangeAdd GetFileType AddAtomW RemoveDirectoryW GetCommMask FoldStringA FindNextFileA OpenFileMappingW FreeEnvironmentStringsW EnumResourceNamesA ReadConsoleOutputCharacterW LocalFree GetVolumeInformationW CreateFileA CloseHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA DebugActiveProcess GetDateFormatW VirtualAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter GetCommandLineA GetStartupInfoA GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA HeapAlloc HeapFree RaiseException TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement HeapSize EnterCriticalSection LeaveCriticalSection TerminateProcess GetCurrentProcess IsDebuggerPresent MultiByteToWideChar ReadFile SetHandleCount DeleteCriticalSection SetFilePointer FreeEnvironmentStringsA GetEnvironmentStrings WideCharToMultiByte GetEnvironmentStringsW HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount HeapReAlloc GetModuleHandleA GetACP GetOEMCP IsValidCodePage RtlUnwind SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers GetLocaleInfoA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

user32

GetMessagePos LoadMenuA GetWindowTextLengthA LoadMenuW CreateWindowStationA CharToOemBuffW ChangeDisplaySettingsA

gdi32

CreateDCA

advapi32

InitiateSystemShutdownA

ole32

CoMarshalHresult