file[.]exe | Triage™

General

Target
file.exe
Size 286KB
Sample231004-ye8kmsge33
SHA256 d0c12de8d2a6fbe5508aee9868550ec7927270bf824d0151e01cc7e6f01bbc66
MD5 9ee1ffdcdb9d3e7a492761bef286d23c
SHA1 125828f1e5efc3c2c0bf4033e0d8823749d72f9e
SHA512 4f5ef7f422341b5b4ce93e1ccf40bf073eda841ecae3952b444076afbb7bd97c9fda9ab2cc12b98587cf92fd87f7fc6c5c6e0af45a2f6048fa31ddf601d63825
SSDEEP 6144:EObeyJ8pXyQ5HhoegxaaIhUjFBgTxq3nQwfX7/QmB/txFwJV:EObr8RyQ5yQaiuFO83nQC0r
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 286KB

file.exe

IMPHASH af52538c49e68cf6a3fee4a7384c59a3
SHA256 d0c12de8d2a6fbe5508aee9868550ec7927270bf824d0151e01cc7e6f01bbc66
MD5 9ee1ffdcdb9d3e7a492761bef286d23c
SHA1 125828f1e5efc3c2c0bf4033e0d8823749d72f9e
SHA512 4f5ef7f422341b5b4ce93e1ccf40bf073eda841ecae3952b444076afbb7bd97c9fda9ab2cc12b98587cf92fd87f7fc6c5c6e0af45a2f6048fa31ddf601d63825
SSDEEP 6144:EObeyJ8pXyQ5HhoegxaaIhUjFBgTxq3nQwfX7/QmB/txFwJV:EObr8RyQ5yQaiuFO83nQC0r
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

27324

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetDateFormatW FillConsoleOutputCharacterA EnumResourceNamesW SetVolumeLabelA EndUpdateResourceW GetConsoleAliasA WritePrivateProfileSectionA GetSystemWindowsDirectoryW InterlockedCompareExchange SetComputerNameW AddConsoleAliasW SetVolumeMountPointW _lclose MoveFileWithProgressA GetTickCount GetNumberFormatA CreateActCtxW SetProcessPriorityBoost GetVolumeInformationA GlobalFindAtomA LoadLibraryW TerminateThread ReadConsoleInputA SizeofResource GetFileAttributesA TransactNamedPipe FindNextVolumeW CreateSemaphoreA FileTimeToSystemTime GetCompressedFileSizeA GetACP SetLastError ReadConsoleOutputCharacterA GetProcAddress VirtualAlloc PeekConsoleInputW RemoveDirectoryA EnumSystemCodePagesW _hwrite InterlockedExchangeAdd LocalAlloc GetFileType CreateHardLinkW AddAtomW BeginUpdateResourceA GetCommMask FoldStringW FindNextFileA FreeEnvironmentStringsW VirtualProtect TerminateJobObject GetWindowsDirectoryW GetCurrentProcessId OpenFileMappingA LocalFree GetProcessHeap SetEndOfFile GetLocaleInfoA UnhandledExceptionFilter SetUnhandledExceptionFilter MultiByteToWideChar GetModuleHandleW Sleep ExitProcess GetCommandLineA GetStartupInfoA GetLastError WriteFile GetStdHandle GetModuleFileNameA TerminateProcess GetCurrentProcess IsDebuggerPresent HeapAlloc HeapFree RaiseException WideCharToMultiByte GetConsoleCP GetConsoleMode FlushFileBuffers DeleteCriticalSection LeaveCriticalSection EnterCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement HeapSize RtlUnwind ReadFile GetCPInfo GetOEMCP IsValidCodePage SetHandleCount SetFilePointer LoadLibraryA InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings GetEnvironmentStringsW HeapCreate VirtualFree QueryPerformanceCounter GetSystemTimeAsFileTime HeapReAlloc GetModuleHandleA WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CloseHandle CreateFileA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

user32

GetWindowTextLengthW CharUpperBuffW LoadBitmapA LoadMenuA LoadMenuW SetMenu CharToOemBuffW ChangeDisplaySettingsA GetMessagePos

Sharing