file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 345KB
Sample231007-a47smsge9x
SHA256 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37
MD5 1860ebf427dccac7292813bb1fa12e5b
SHA1 d889765ae93d9543ac9725345ab3814490d176a7
SHA512 ed2a155d6128b7c8c958c89e823f3ec7c95ac5770f4bd8731ebcbeb70fa3a8df42a9cf54dec1121a07185766f759ed08b404840fee36c32d320de18acf70db6b
SSDEEP 6144:aMGZ2bjyNNGhGwfAe90daIOT7DGDdJtLYL:RUwjyNoGwxMaJQ7E
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 345KB

file.exe

IMPHASH 1329a392a27bb099e5f0069fb4bf5f7f
SHA256 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37
MD5 1860ebf427dccac7292813bb1fa12e5b
SHA1 d889765ae93d9543ac9725345ab3814490d176a7
SHA512 ed2a155d6128b7c8c958c89e823f3ec7c95ac5770f4bd8731ebcbeb70fa3a8df42a9cf54dec1121a07185766f759ed08b404840fee36c32d320de18acf70db6b
SSDEEP 6144:aMGZ2bjyNNGhGwfAe90daIOT7DGDdJtLYL:RUwjyNoGwxMaJQ7E
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19931

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetConsoleAliasExesA CommConfigDialogA FindResourceW InterlockedDecrement SetDefaultCommConfigW QueryPerformanceCounter GetNamedPipeHandleStateA GetEnvironmentStringsW GetComputerNameW OpenSemaphoreA CreateHardLinkA FreeEnvironmentStringsA SetTapeParameters FindNextVolumeMountPointA ConvertFiberToThread ReadConsoleW WaitNamedPipeW EnumTimeFormatsA WriteFile GetCommandLineA GetDriveTypeA GetEnvironmentStrings FindResourceExA GetConsoleCP GlobalAlloc LoadLibraryW GetLocaleInfoW CopyFileW GetCalendarInfoA IsBadCodePtr SetConsoleCP DeleteVolumeMountPointW InterlockedPopEntrySList GetFileAttributesA EnumSystemCodePagesA SetConsoleMode SetSystemPowerState GetAtomNameW IsDBCSLeadByte GetModuleHandleExA GetACP GetVolumePathNameA GetStartupInfoW CreateMailslotW DisconnectNamedPipe GetShortPathNameA GetConsoleAliasesW InterlockedExchange GetLastError SetLastError ReadConsoleOutputCharacterA PeekConsoleInputW EnumSystemCodePagesW SetComputerNameA FindClose InterlockedExchangeAdd SetConsoleCtrlHandler RemoveDirectoryW AddAtomA HeapWalk OpenJobObjectW SetCommMask GetPrivateProfileSectionNamesA FindNextFileA EnumDateFormatsA GetModuleHandleA GetStringTypeW VirtualProtect GetShortPathNameW SetCalendarInfoA ReadConsoleInputW GetWindowsDirectoryW FindFirstVolumeW GetVolumeNameForVolumeMountPointW DeleteFileW GetCurrentProcessId AddConsoleAliasA ReadFile WriteConsoleW WriteConsoleInputW GetConsoleAliasesLengthW GetCompressedFileSizeA GetTempFileNameW WideCharToMultiByte MoveFileA HeapFree HeapAlloc GetProcAddress GetModuleHandleW ExitProcess DecodePointer HeapReAlloc GetCommandLineW HeapSetInformation RaiseException GetCPInfo InterlockedIncrement GetOEMCP IsValidCodePage EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess IsProcessorFeaturePresent HeapCreate EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection GetModuleFileNameW SetFilePointer CloseHandle FreeEnvironmentStringsW GetTickCount GetSystemTimeAsFileTime LCMapStringW MultiByteToWideChar Sleep GetConsoleMode RtlUnwind SetStdHandle FlushFileBuffers HeapSize CreateFileW

user32

CharUpperBuffA CharUpperW

gdi32

GetKerningPairsA

advapi32

RevertToSelf

winhttp

WinHttpReadData