file[.]exe | Triage™

General

Target
file.exe
Size 255KB
Sample231005-p2cbaach98
SHA256 8dd45c3deaa091c3bdde3456ffde09709d17802c57d4d6dbdf6fc5d5d1e3c8fc
MD5 6569eceef4279ce644844d4183d91a35
SHA1 54e7b4001ff59286a31e4c3b29905f7e8bb1789a
SHA512 4cfd05afee174675e4c1c90c87a4b897c1c84a112e6805cc959aa313ec018428d7360bb585d5a513d52d3c0b2508236f16ad5f69f0234953a672975e7735c87c
SSDEEP 3072:3iyY7Rc0xtWBj4OsUPm2+GHYOcFci7OaMQrbN7WcAPAwlNOwjsOPWxDIkaNaL5sY:SyY7RKBMbUmGbcknE9WxYwztsPckaG
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 255KB

file.exe

IMPHASH b2deb6462ddc9e096b1ba263bc3b3e01
SHA256 8dd45c3deaa091c3bdde3456ffde09709d17802c57d4d6dbdf6fc5d5d1e3c8fc
MD5 6569eceef4279ce644844d4183d91a35
SHA1 54e7b4001ff59286a31e4c3b29905f7e8bb1789a
SHA512 4cfd05afee174675e4c1c90c87a4b897c1c84a112e6805cc959aa313ec018428d7360bb585d5a513d52d3c0b2508236f16ad5f69f0234953a672975e7735c87c
SSDEEP 3072:3iyY7Rc0xtWBj4OsUPm2+GHYOcFci7OaMQrbN7WcAPAwlNOwjsOPWxDIkaNaL5sY:SyY7RKBMbUmGbcknE9WxYwztsPckaG
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

18261

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetSystemWindowsDirectoryW InterlockedCompareExchange AddConsoleAliasW _lclose GetTickCount GetNumberFormatA GetWindowsDirectoryA SetProcessPriorityBoost GlobalAlloc GlobalFindAtomA LoadLibraryW SizeofResource SetVolumeMountPointA TransactNamedPipe GetFileAttributesW GetCompressedFileSizeA CreateActCtxA GetACP FillConsoleOutputCharacterW SetLastError ReadConsoleOutputCharacterA GetProcAddress VirtualAlloc BeginUpdateResourceW RemoveDirectoryA EnumSystemCodePagesW SetComputerNameA _hwrite CreateHardLinkW AddAtomW BeginUpdateResourceA GetCommMask FoldStringW OpenFileMappingW FreeEnvironmentStringsW FindNextFileW VirtualProtect PeekConsoleInputA OpenSemaphoreW EndUpdateResourceA ReadConsoleInputW TerminateJobObject GetCurrentProcessId LocalFree FindNextVolumeA GetProcessHeap SetEndOfFile UnhandledExceptionFilter SetUnhandledExceptionFilter MultiByteToWideChar GetModuleHandleW Sleep ExitProcess GetCommandLineA GetStartupInfoA GetLastError WriteFile GetStdHandle GetModuleFileNameA TerminateProcess GetCurrentProcess IsDebuggerPresent HeapAlloc HeapFree RaiseException EnterCriticalSection LeaveCriticalSection SetHandleCount GetFileType DeleteCriticalSection WideCharToMultiByte GetConsoleCP GetConsoleMode FlushFileBuffers TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement HeapSize RtlUnwind ReadFile GetCPInfo GetOEMCP IsValidCodePage SetFilePointer LoadLibraryA InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings GetEnvironmentStringsW HeapCreate VirtualFree QueryPerformanceCounter GetSystemTimeAsFileTime HeapReAlloc GetModuleHandleA WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CloseHandle CreateFileA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA

user32

LoadMenuW CharToOemBuffW ChangeDisplaySettingsA GetMessagePos GetWindowTextLengthA

Sharing