file[.]exe | Triage™

General

Target
file.exe
Size 308KB
Sample231004-az7xvaaa97
SHA256 7cdde4d499e3fb8560558be03daef16feb69be0ebfaf717750e91c5c2083e121
MD5 12d74357bf35659671317f968f228af1
SHA1 abc3efb487144c174c79ac7a6e604c539540bbd6
SHA512 87a12f0a10de3da8505ad5044288e9d72e71718a4a73d5a27af12a3b4721786903486f99b2f5596d111fa4b75a67fbc27b68dbd245cdbdaadd7893ba81c164be
SSDEEP 6144:3jWxACgIaxp1rvmKAjCWZyIOO+fqpxUy:3MJcxp9+Nxg1Cpx
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 308KB

file.exe

IMPHASH 5396cb3c2c0a90a20f01488724a0b793
SHA256 7cdde4d499e3fb8560558be03daef16feb69be0ebfaf717750e91c5c2083e121
MD5 12d74357bf35659671317f968f228af1
SHA1 abc3efb487144c174c79ac7a6e604c539540bbd6
SHA512 87a12f0a10de3da8505ad5044288e9d72e71718a4a73d5a27af12a3b4721786903486f99b2f5596d111fa4b75a67fbc27b68dbd245cdbdaadd7893ba81c164be
SSDEEP 6144:3jWxACgIaxp1rvmKAjCWZyIOO+fqpxUy:3MJcxp9+Nxg1Cpx
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

23499

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetDefaultCommConfigA WriteConsoleInputW GetConsoleAliasesLengthW GetModuleHandleExA GetLocaleInfoA GetConsoleAliasExesA CommConfigDialogA FindResourceW BuildCommDCBAndTimeoutsA EnumCalendarInfoW ReadConsoleA InterlockedDecrement InitializeSListHead GetNamedPipeHandleStateA SetComputerNameW GetComputerNameW OpenSemaphoreA FreeEnvironmentStringsA GenerateConsoleCtrlEvent FindNextVolumeMountPointA GetCompressedFileSizeW WaitNamedPipeW EnumTimeFormatsA EnumTimeFormatsW GetCommandLineA GetDriveTypeA GetEnvironmentStrings FindResourceExA GetConsoleCP LoadLibraryW GetConsoleMode GetCalendarInfoW IsBadCodePtr SetConsoleCP DeleteVolumeMountPointW GetFileAttributesA EnumSystemCodePagesA HeapQueryInformation SetSystemPowerState GetAtomNameW GetVolumePathNameA GetTempFileNameW CreateMailslotW DisconnectNamedPipe FlushFileBuffers GetShortPathNameA GetConsoleAliasesW InterlockedExchange GetLastError IsDBCSLeadByteEx SetLastError ReadConsoleOutputCharacterA PeekConsoleInputW MoveFileW EnumSystemCodePagesW FindClose LoadLibraryA InterlockedExchangeAdd LocalAlloc SetCalendarInfoW CreateHardLinkW AddAtomW RemoveDirectoryW OpenJobObjectW GetTapeParameters GetPrivateProfileSectionNamesA GetOEMCP EnumDateFormatsA GetModuleHandleA FindNextFileW GetStringTypeW VirtualProtect PurgeComm QueryPerformanceFrequency FindFirstVolumeA ReadConsoleInputW GetWindowsDirectoryW DeleteFileW GetCurrentProcessId AddConsoleAliasA ReadConsoleOutputCharacterW SwitchToThread CreateFileW ReadFile WriteConsoleW GetCommandLineW GetStartupInfoW GetVolumeNameForVolumeMountPointA WideCharToMultiByte MoveFileA HeapFree HeapAlloc GetProcAddress GetModuleHandleW ExitProcess DecodePointer HeapReAlloc HeapSetInformation RaiseException GetCPInfo InterlockedIncrement GetACP IsValidCodePage EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess IsProcessorFeaturePresent HeapCreate WriteFile GetStdHandle GetModuleFileNameW EnterCriticalSection LeaveCriticalSection SetFilePointer SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection CloseHandle FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime LCMapStringW MultiByteToWideChar Sleep SetStdHandle RtlUnwind HeapSize DeleteFileA

user32

CharUpperBuffA CharUpperA

gdi32

GetKerningPairsA GetCharWidthW

Sharing