file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 345KB
Sample231007-ll3azsae3t
SHA256 658d9ea4093e492a0f1a8cc6e054e65d2ea30f22fd179b1e1ca58c17618690e9
MD5 93ebac23d004441f2792c36b731845c4
SHA1 1fa7dd46ebea5b4c476d97d5126f021dcd9ea69f
SHA512 be7711557dc0cf6cc3d5dfa3e478f8231f7a76c8e1f602fecd1f3f8a04ad024177859a7e47cba245c38adfc966c6d5e7f95104b076a02f5c147d1dcbd56ee0f1
SSDEEP 6144:gNZ8nMtxUX84p2nxG0FGebTmCuNQ8g1WKLe:oaMvUX87xr9bKQ/1nS
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 345KB

file.exe

IMPHASH 87f03000e6499d0f071e10e3a4f854c0
SHA256 658d9ea4093e492a0f1a8cc6e054e65d2ea30f22fd179b1e1ca58c17618690e9
MD5 93ebac23d004441f2792c36b731845c4
SHA1 1fa7dd46ebea5b4c476d97d5126f021dcd9ea69f
SHA512 be7711557dc0cf6cc3d5dfa3e478f8231f7a76c8e1f602fecd1f3f8a04ad024177859a7e47cba245c38adfc966c6d5e7f95104b076a02f5c147d1dcbd56ee0f1
SSDEEP 6144:gNZ8nMtxUX84p2nxG0FGebTmCuNQ8g1WKLe:oaMvUX87xr9bKQ/1nS
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19755

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindResourceW OpenJobObjectA InterlockedDecrement SetDefaultCommConfigW QueryPerformanceCounter GetNamedPipeHandleStateA GetEnvironmentStringsW GetComputerNameW OpenSemaphoreA CreateHardLinkA FreeEnvironmentStringsA SetTapeParameters SetThreadUILanguage FindNextVolumeMountPointA ConvertFiberToThread ReadConsoleW GetConsoleAliasExesW WaitNamedPipeW EnumTimeFormatsA WriteFile GetCommandLineA GetDriveTypeA GetEnvironmentStrings FindResourceExA GetConsoleCP GlobalAlloc LoadLibraryW GetLocaleInfoW ReadConsoleInputA CopyFileW GetCalendarInfoA IsBadCodePtr SetConsoleCP DeleteVolumeMountPointW InterlockedPopEntrySList GetFileAttributesA EnumSystemCodePagesA SetConsoleMode SetSystemPowerState CommConfigDialogA IsDBCSLeadByte GetCompressedFileSizeA GetACP GetVolumePathNameA GetStartupInfoW CreateMailslotW DisconnectNamedPipe GetShortPathNameA GetConsoleAliasesW InterlockedExchange GetLastError SetLastError ReadConsoleOutputCharacterA PeekConsoleInputW EnumSystemCodePagesW SetComputerNameA GetTempFileNameA FindClose InterlockedExchangeAdd SetConsoleCtrlHandler RemoveDirectoryW AddAtomA HeapWalk SetCommMask GetPrivateProfileSectionNamesA FindNextFileA EnumDateFormatsA GetModuleHandleA GetStringTypeW VirtualProtect GetShortPathNameW SetCalendarInfoA GetWindowsDirectoryW FindFirstVolumeW GetVolumeNameForVolumeMountPointW DeleteFileW AddConsoleAliasA ReadFile WriteConsoleW GetConsoleAliasesLengthW GetModuleHandleExA GetAtomNameW WriteConsoleInputW WideCharToMultiByte MoveFileA HeapFree HeapAlloc GetProcAddress GetModuleHandleW ExitProcess DecodePointer HeapReAlloc GetCommandLineW HeapSetInformation RaiseException GetCPInfo InterlockedIncrement GetOEMCP IsValidCodePage EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess IsProcessorFeaturePresent HeapCreate EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection GetModuleFileNameW SetFilePointer CloseHandle FreeEnvironmentStringsW GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringW MultiByteToWideChar Sleep GetConsoleMode RtlUnwind SetStdHandle FlushFileBuffers HeapSize CreateFileW

user32

CharUpperBuffA CharUpperW

gdi32

GetKerningPairsA

advapi32

RevertToSelf

winhttp

WinHttpReadData