file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 274KB
Sample231007-back3sah34
SHA256 c84537973b86166aa9be5395f16c7669bf92b3e83abfe8f714fd2a75e8635bea
MD5 ccb6c3a863ab67a18d1779011bf8583d
SHA1 dc4bfecae949aa221fba749c67b15dee40f91fbc
SHA512 91c60bca5438e38202e62743e78118e1579174e99ce29773b303317e701aae7146914eaf758fbacc2e7fa4ea8420c4b498a0894d83d133e6ff5a0fd0651ac597
SSDEEP 3072:YgacdZG7phkM3++8RMLKCIkvazbUy6xDzC2IqoM/oP8:jjZihk0OCv6bU7DzLoMAP
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 274KB

file.exe

IMPHASH 1329a392a27bb099e5f0069fb4bf5f7f
SHA256 c84537973b86166aa9be5395f16c7669bf92b3e83abfe8f714fd2a75e8635bea
MD5 ccb6c3a863ab67a18d1779011bf8583d
SHA1 dc4bfecae949aa221fba749c67b15dee40f91fbc
SHA512 91c60bca5438e38202e62743e78118e1579174e99ce29773b303317e701aae7146914eaf758fbacc2e7fa4ea8420c4b498a0894d83d133e6ff5a0fd0651ac597
SSDEEP 3072:YgacdZG7phkM3++8RMLKCIkvazbUy6xDzC2IqoM/oP8:jjZihk0OCv6bU7DzLoMAP
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19931

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetConsoleAliasExesA CommConfigDialogA FindResourceW InterlockedDecrement SetDefaultCommConfigW QueryPerformanceCounter GetNamedPipeHandleStateA GetEnvironmentStringsW GetComputerNameW OpenSemaphoreA CreateHardLinkA FreeEnvironmentStringsA SetTapeParameters FindNextVolumeMountPointA ConvertFiberToThread ReadConsoleW WaitNamedPipeW EnumTimeFormatsA WriteFile GetCommandLineA GetDriveTypeA GetEnvironmentStrings FindResourceExA GetConsoleCP GlobalAlloc LoadLibraryW GetLocaleInfoW CopyFileW GetCalendarInfoA IsBadCodePtr SetConsoleCP DeleteVolumeMountPointW InterlockedPopEntrySList GetFileAttributesA EnumSystemCodePagesA SetConsoleMode SetSystemPowerState GetAtomNameW IsDBCSLeadByte GetModuleHandleExA GetACP GetVolumePathNameA GetStartupInfoW CreateMailslotW DisconnectNamedPipe GetShortPathNameA GetConsoleAliasesW InterlockedExchange GetLastError SetLastError ReadConsoleOutputCharacterA PeekConsoleInputW EnumSystemCodePagesW SetComputerNameA FindClose InterlockedExchangeAdd SetConsoleCtrlHandler RemoveDirectoryW AddAtomA HeapWalk OpenJobObjectW SetCommMask GetPrivateProfileSectionNamesA FindNextFileA EnumDateFormatsA GetModuleHandleA GetStringTypeW VirtualProtect GetShortPathNameW SetCalendarInfoA ReadConsoleInputW GetWindowsDirectoryW FindFirstVolumeW GetVolumeNameForVolumeMountPointW DeleteFileW GetCurrentProcessId AddConsoleAliasA ReadFile WriteConsoleW WriteConsoleInputW GetConsoleAliasesLengthW GetCompressedFileSizeA GetTempFileNameW WideCharToMultiByte MoveFileA HeapFree HeapAlloc GetProcAddress GetModuleHandleW ExitProcess DecodePointer HeapReAlloc GetCommandLineW HeapSetInformation RaiseException GetCPInfo InterlockedIncrement GetOEMCP IsValidCodePage EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess IsProcessorFeaturePresent HeapCreate EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection GetModuleFileNameW SetFilePointer CloseHandle FreeEnvironmentStringsW GetTickCount GetSystemTimeAsFileTime LCMapStringW MultiByteToWideChar Sleep GetConsoleMode RtlUnwind SetStdHandle FlushFileBuffers HeapSize CreateFileW

user32

CharUpperBuffA CharUpperW

gdi32

GetKerningPairsA

advapi32

RevertToSelf

winhttp

WinHttpReadData