file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 357KB
Sample231007-z56dmsfd4x
SHA256 53d10bf98c4e290949b6efe10418a674c737c837ad85fcd47baeeaaa8d72ddcf
MD5 67722a457caad043616041026db142a7
SHA1 b3dd01f71ccceaa08316f41205cb5424657a918b
SHA512 d50f6ce8ea81efbf0229fdb959d2beaa5e63a2417e91a459a7bdd0cc4ead64181b328219aa894fae507a5822ea833aa364cbd30ac1591b8b5036d92eda271822
SSDEEP 6144:FsRW4Qc+N500ltmewMKYO+U4oxOrc8fVZT2p76VjxeTNAZJa:FH/cc504mpMKYO/4o4XfVYp7QNeuy
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 357KB

file.exe

IMPHASH 99d7d9dbac9e758617de32e3b7e0aa88
SHA256 53d10bf98c4e290949b6efe10418a674c737c837ad85fcd47baeeaaa8d72ddcf
MD5 67722a457caad043616041026db142a7
SHA1 b3dd01f71ccceaa08316f41205cb5424657a918b
SHA512 d50f6ce8ea81efbf0229fdb959d2beaa5e63a2417e91a459a7bdd0cc4ead64181b328219aa894fae507a5822ea833aa364cbd30ac1591b8b5036d92eda271822
SSDEEP 6144:FsRW4Qc+N500ltmewMKYO+U4oxOrc8fVZT2p76VjxeTNAZJa:FH/cc504mpMKYO/4o4XfVYp7QNeuy
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

OpenJobObjectA InterlockedDecrement SetDefaultCommConfigW QueryPerformanceCounter GetEnvironmentStringsW InterlockedCompareExchange WriteConsoleInputA GetComputerNameW OpenSemaphoreA CreateHardLinkA SetTapeParameters SetThreadUILanguage FindNextVolumeMountPointA ConvertFiberToThread ReadConsoleW GetCompressedFileSizeW GetConsoleAliasExesW WaitNamedPipeW EnumTimeFormatsA WriteFile GetCommandLineA GetDriveTypeA GetVolumePathNameW FindResourceExA GetConsoleCP GlobalAlloc LoadLibraryW GetLocaleInfoW ReadConsoleInputA CopyFileW GetCalendarInfoA SetConsoleCP DeleteVolumeMountPointW InterlockedPopEntrySList GetFileAttributesA EnumSystemCodePagesA SetConsoleMode SetSystemPowerState FindResourceW GetACP GetStartupInfoW CreateMailslotW DisconnectNamedPipe GetShortPathNameA GetNamedPipeHandleStateW GetConsoleAliasesW InterlockedExchange GetLastError SetLastError ReadConsoleOutputCharacterA PeekConsoleInputW SetVolumeLabelW SetComputerNameA GetTempFileNameA FindClose GetAtomNameA InterlockedExchangeAdd SetCalendarInfoW SetConsoleCtrlHandler RemoveDirectoryW AddAtomA HeapWalk SetCommMask GetPrivateProfileSectionNamesA FindNextFileA EnumDateFormatsA GetModuleHandleA FreeEnvironmentStringsW GetStringTypeW VirtualProtect GetWindowsDirectoryW FindFirstVolumeW GetVolumeNameForVolumeMountPointW DeleteFileW AddConsoleAliasA ReadFile WriteConsoleW GetModuleHandleExA CommConfigDialogA IsDBCSLeadByte GetConsoleAliasesLengthW WideCharToMultiByte MoveFileA HeapFree HeapAlloc GetProcAddress GetModuleHandleW ExitProcess DecodePointer HeapReAlloc GetCommandLineW HeapSetInformation RaiseException GetCPInfo InterlockedIncrement GetOEMCP IsValidCodePage EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess IsProcessorFeaturePresent HeapCreate GetStdHandle GetModuleFileNameW EnterCriticalSection LeaveCriticalSection SetFilePointer SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection CloseHandle GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringW MultiByteToWideChar Sleep SetStdHandle GetConsoleMode FlushFileBuffers RtlUnwind HeapSize CreateFileW

user32

CharUpperBuffA CharUpperW

gdi32

GetKerningPairsA

advapi32

RevertToSelf

winhttp

WinHttpReadData