file[.]exe | Triage™

General

Target
file.exe
Size 251KB
Sample231005-31prwaaa98
SHA256 3d03eed9848645fde88610e9d0b08070dfa6713264111e1eea6911dfa2bef751
MD5 a5ac5a96beb2ff5f78d7c38949b0040d
SHA1 356913a71ec7eadc5ddfdb21844cb617aafb013f
SHA512 8774268e06f3e2743179719e43e812fb6de0386630c53c60eec81ba614f25fb8667aa2d8fee5742feb6083d4e2fc0340fb105f502acfa407745623e8cc5ccc81
SSDEEP 3072:Wj8qqtU/fpOZptioUkGaVMejZmlXrON0L/0VFnSXfJNW+lJyZu/dL/P5tLt:EEtqOHDP7Z+gvSXxsQ7bL
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 251KB

file.exe

IMPHASH d3c94bb73994a0063781772af4feb487
SHA256 3d03eed9848645fde88610e9d0b08070dfa6713264111e1eea6911dfa2bef751
MD5 a5ac5a96beb2ff5f78d7c38949b0040d
SHA1 356913a71ec7eadc5ddfdb21844cb617aafb013f
SHA512 8774268e06f3e2743179719e43e812fb6de0386630c53c60eec81ba614f25fb8667aa2d8fee5742feb6083d4e2fc0340fb105f502acfa407745623e8cc5ccc81
SSDEEP 3072:Wj8qqtU/fpOZptioUkGaVMejZmlXrON0L/0VFnSXfJNW+lJyZu/dL/P5tLt:EEtqOHDP7Z+gvSXxsQ7bL
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

17466

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedCompareExchange AddConsoleAliasW _lclose GetTickCount GetNumberFormatA GetWindowsDirectoryA SetProcessPriorityBoost GlobalAlloc LoadLibraryW ReadConsoleInputA SetVolumeMountPointA GetSystemWindowsDirectoryA GetFileAttributesW GetCompressedFileSizeA CreateActCtxA GetACP SetLastError ReadConsoleOutputCharacterA GetProcAddress VirtualAlloc BeginUpdateResourceW RemoveDirectoryA EnumSystemCodePagesW SetComputerNameA EndUpdateResourceW CreateHardLinkW AddAtomW BeginUpdateResourceA GetCommMask FoldStringA GlobalFindAtomW OpenFileMappingW FreeEnvironmentStringsW FindNextFileW VirtualProtect PeekConsoleInputA TerminateJobObject GetCurrentProcessId FindNextVolumeA GetProcessHeap SetEndOfFile FlushFileBuffers LoadResource PeekNamedPipe GlobalFree FillConsoleOutputCharacterA UnhandledExceptionFilter SetUnhandledExceptionFilter MultiByteToWideChar GetModuleHandleW Sleep ExitProcess GetCommandLineA GetStartupInfoA GetLastError WriteFile GetStdHandle GetModuleFileNameA TerminateProcess GetCurrentProcess IsDebuggerPresent HeapAlloc HeapFree RaiseException GetCPInfo InterlockedIncrement InterlockedDecrement GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId HeapSize EnterCriticalSection LeaveCriticalSection RtlUnwind ReadFile DeleteCriticalSection LoadLibraryA InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType HeapCreate VirtualFree QueryPerformanceCounter GetSystemTimeAsFileTime SetFilePointer GetConsoleCP GetConsoleMode HeapReAlloc GetModuleHandleA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA CloseHandle CreateFileA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW

user32

CharToOemBuffA PostMessageW LoadMenuW ChangeDisplaySettingsA GetWindowTextLengthW

gdi32

GetPolyFillMode GetCharacterPlacementW

advapi32

BackupEventLogA

Sharing