file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 386KB
Sample231002-pkfx5scd32
SHA256 1484ed2f76955234e93ba8871fb2c9d4cbbb94cedad3bee250bee8cbef806562
MD5 18d1dcbe1eb837ddf3310bce913b20c9
SHA1 9159c43363126c96b348465a3612d2e69bd3654e
SHA512 7ac511c543ddc5e7b78b2f828a49db204e64fad692aeec1f59d0f5cd3486ff996bafc407ead73b91746975078dbed63ac0c3aa45a6e01e1460414d2a4660d43c
SSDEEP 6144:2C6OZWlZyOQ38bp1TIk86hzexJ6WzooXt8RAd16Jp2QV:2VGWyOQ38XTIkfom8t9W8O
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 386KB

file.exe

IMPHASH 5d35fce13cfe2b1d2850575b7eeb2ceb
SHA256 1484ed2f76955234e93ba8871fb2c9d4cbbb94cedad3bee250bee8cbef806562
MD5 18d1dcbe1eb837ddf3310bce913b20c9
SHA1 9159c43363126c96b348465a3612d2e69bd3654e
SHA512 7ac511c543ddc5e7b78b2f828a49db204e64fad692aeec1f59d0f5cd3486ff996bafc407ead73b91746975078dbed63ac0c3aa45a6e01e1460414d2a4660d43c
SSDEEP 6144:2C6OZWlZyOQ38bp1TIk86hzexJ6WzooXt8RAd16Jp2QV:2VGWyOQ38XTIkfom8t9W8O
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18476

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

RemoveVectoredExceptionHandler GetCPInfo EndUpdateResourceW OpenJobObjectA ReadConsoleA InterlockedCompareExchange AddConsoleAliasW CreateHardLinkA MoveFileWithProgressA GetTickCount GetNumberFormatA GetWindowsDirectoryA GlobalFindAtomA LoadLibraryW TerminateThread ReadConsoleInputA SizeofResource SetVolumeMountPointA GetFileAttributesA TransactNamedPipe FindNextVolumeW CreateSemaphoreA WritePrivateProfileSectionW FileTimeToSystemTime GetLastError SetLastError GetProcAddress SetVolumeLabelA BeginUpdateResourceW EnumSystemCodePagesW OpenWaitableTimerA LoadLibraryA InterlockedExchangeAdd GetFileType AddAtomW RemoveDirectoryW GetCommMask FoldStringA FindNextFileA OpenFileMappingW FreeEnvironmentStringsW EnumResourceNamesA ReadConsoleOutputCharacterW LocalFree GetVolumeInformationW CreateFileA CloseHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA DebugActiveProcess GetDateFormatW VirtualAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter GetCommandLineA GetStartupInfoA GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA HeapAlloc HeapFree RaiseException TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement HeapSize EnterCriticalSection LeaveCriticalSection TerminateProcess GetCurrentProcess IsDebuggerPresent MultiByteToWideChar ReadFile SetHandleCount DeleteCriticalSection SetFilePointer FreeEnvironmentStringsA GetEnvironmentStrings WideCharToMultiByte GetEnvironmentStringsW HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount HeapReAlloc GetModuleHandleA GetACP GetOEMCP IsValidCodePage RtlUnwind SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers GetLocaleInfoA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

user32

GetMessagePos LoadMenuA GetWindowTextLengthA LoadMenuW CreateWindowStationA CharToOemBuffW ChangeDisplaySettingsA

gdi32

CreateDCA

advapi32

InitiateSystemShutdownA

ole32

CoMarshalHresult