file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 357KB
Sample231007-zbt4hshf53
SHA256 030c0eab77f63f34b1d09730a8d01a6e5c128c564f75e8f24dddf1a9c1917507
MD5 70e2954665af2b32977bc042e6fd0bb0
SHA1 12a72a16c8a94a60e84521cfca467ce50d326f44
SHA512 129010ed0b92a88d01b37b1bb999e730df527f35a7c80784a1d082069aaa5ca88ac067bff1186b99bde35047dc0b665ba98e46f77be59ee5b345a00572496979
SSDEEP 6144:nufWK/7U5yaZIGPSG+RZvoi3Wk6VVBPSfPclB6w+:nDi7052NRZX3WpVVBPTlBQ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 357KB

file.exe

IMPHASH 7c1eb63cbfee83dc3af6e952fc6d57b5
SHA256 030c0eab77f63f34b1d09730a8d01a6e5c128c564f75e8f24dddf1a9c1917507
MD5 70e2954665af2b32977bc042e6fd0bb0
SHA1 12a72a16c8a94a60e84521cfca467ce50d326f44
SHA512 129010ed0b92a88d01b37b1bb999e730df527f35a7c80784a1d082069aaa5ca88ac067bff1186b99bde35047dc0b665ba98e46f77be59ee5b345a00572496979
SSDEEP 6144:nufWK/7U5yaZIGPSG+RZvoi3Wk6VVBPSfPclB6w+:nDi7052NRZX3WpVVBPTlBQ
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21614

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindResourceW OpenJobObjectA InterlockedDecrement SetDefaultCommConfigW QueryPerformanceCounter GetNamedPipeHandleStateA GetEnvironmentStringsW InterlockedCompareExchange WriteConsoleInputA GetComputerNameW OpenSemaphoreA CreateHardLinkA SetTapeParameters SetThreadUILanguage FindNextVolumeMountPointA ConvertFiberToThread ReadConsoleW GetConsoleAliasExesW WaitNamedPipeW EnumTimeFormatsA WriteFile GetCommandLineA GetDriveTypeA FindResourceExA GetConsoleCP GlobalAlloc LoadLibraryW GetLocaleInfoW ReadConsoleInputA CopyFileW GetCalendarInfoA SetConsoleCP DeleteVolumeMountPointW InterlockedPopEntrySList GetFileAttributesA EnumSystemCodePagesA SetConsoleMode SetSystemPowerState IsDBCSLeadByte CommConfigDialogA GetACP GetVolumePathNameA GetStartupInfoW CreateMailslotW DisconnectNamedPipe GetShortPathNameA GetConsoleAliasesW InterlockedExchange GetLastError SetLastError ReadConsoleOutputCharacterA PeekConsoleInputW SetVolumeLabelW SetComputerNameA GetTempFileNameA FindClose GetAtomNameA InterlockedExchangeAdd SetConsoleCtrlHandler RemoveDirectoryW AddAtomA HeapWalk SetCommMask GetPrivateProfileSectionNamesA FindNextFileA EnumDateFormatsA GetModuleHandleA FreeEnvironmentStringsW GetStringTypeW VirtualProtect GetShortPathNameW SetCalendarInfoA GetWindowsDirectoryW FindFirstVolumeW GetVolumeNameForVolumeMountPointW DeleteFileW AddConsoleAliasA ReadFile WriteConsoleW GetConsoleAliasesLengthW GetModuleHandleExA GetCompressedFileSizeA WriteConsoleInputW WideCharToMultiByte MoveFileA HeapFree HeapAlloc GetProcAddress GetModuleHandleW ExitProcess DecodePointer HeapReAlloc GetCommandLineW HeapSetInformation RaiseException GetCPInfo InterlockedIncrement GetOEMCP IsValidCodePage EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess IsProcessorFeaturePresent HeapCreate GetStdHandle GetModuleFileNameW EnterCriticalSection LeaveCriticalSection SetFilePointer SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection CloseHandle GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringW MultiByteToWideChar Sleep SetStdHandle GetConsoleMode FlushFileBuffers RtlUnwind HeapSize CreateFileW

user32

CharUpperBuffA CharUpperW

gdi32

GetKerningPairsA

advapi32

RevertToSelf

winhttp

WinHttpReadData