file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 280KB
Sample231008-1573xaaf68
SHA256 7e36265ad76fa6f482fdc09bcf491768d50a06a81fdb932f5b0b995d7af2bb40
MD5 44f9d3e34b4cf0a4d9e795abb847d571
SHA1 94083b0572bb6e1f7e39f79ddbf57ddb6d6403b9
SHA512 8d55643346b3193a9860395b16a75e7b2daf2d7fdf377f090b9324576ba28830e6523af5a10824140b5d15a14e7f4962065ee275fc6189a3a49c0f54f1fd35ae
SSDEEP 3072:jggnaFdL4g68uXydp6jOI4u/0SoJBb0jza64gnQdH8L8wW/aT:jg3Fqt8uXyijOI48m0KmArw
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 280KB

file.exe

IMPHASH 9d37df760655c3ef5d6cbf6ba5a52e51
SHA256 7e36265ad76fa6f482fdc09bcf491768d50a06a81fdb932f5b0b995d7af2bb40
MD5 44f9d3e34b4cf0a4d9e795abb847d571
SHA1 94083b0572bb6e1f7e39f79ddbf57ddb6d6403b9
SHA512 8d55643346b3193a9860395b16a75e7b2daf2d7fdf377f090b9324576ba28830e6523af5a10824140b5d15a14e7f4962065ee275fc6189a3a49c0f54f1fd35ae
SSDEEP 3072:jggnaFdL4g68uXydp6jOI4u/0SoJBb0jza64gnQdH8L8wW/aT:jg3Fqt8uXyijOI48m0KmArw
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19787

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleExA CommConfigDialogA FindResourceW DeleteVolumeMountPointA OpenJobObjectA InterlockedDecrement SetDefaultCommConfigW QueryPerformanceCounter GetEnvironmentStringsW InterlockedCompareExchange WriteConsoleInputA OpenSemaphoreA CreateHardLinkA SetTapeParameters SetThreadUILanguage FindNextVolumeMountPointA GetConsoleAliasesA GetConsoleAliasesLengthA ConvertFiberToThread ReadConsoleW GetCompressedFileSizeW GetConsoleAliasExesW WaitNamedPipeW WriteFile EnumTimeFormatsW GetCommandLineA GetDriveTypeA GetVolumePathNameW FindResourceExA GetConsoleCP GlobalAlloc LoadLibraryW GetConsoleMode GetLocaleInfoW ReadConsoleInputA CopyFileW GetCalendarInfoA SetConsoleCP GetFileAttributesA EnumSystemCodePagesA WriteConsoleInputW SetSystemPowerState IsDBCSLeadByte GetACP CreateMailslotW GetShortPathNameA GetNamedPipeHandleStateW InterlockedExchange GetStartupInfoA GetLastError SetLastError ReadConsoleOutputCharacterA SetVolumeLabelW RemoveDirectoryA EnumSystemCodePagesW FreeUserPhysicalPages SetComputerNameA FindClose GetAtomNameA SetCalendarInfoW MoveFileA SetConsoleCtrlHandler AddAtomA HeapWalk SetCommMask GetPrivateProfileSectionNamesA FindNextFileA _lread GetModuleHandleA FreeEnvironmentStringsW GetStringTypeW VirtualProtect EnumDateFormatsW PeekConsoleInputA GetWindowsDirectoryW FindFirstVolumeW GetVolumeNameForVolumeMountPointW DeleteFileW WriteConsoleW GetComputerNameA GetTempFileNameW SetConsoleMode GetCommandLineW HeapFree HeapAlloc GetProcAddress GetModuleHandleW ExitProcess DecodePointer WideCharToMultiByte HeapReAlloc HeapSetInformation GetStartupInfoW RaiseException IsProcessorFeaturePresent HeapCreate GetStdHandle GetModuleFileNameW EncodePointer EnterCriticalSection LeaveCriticalSection SetFilePointer SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId GetCPInfo GetOEMCP IsValidCodePage CloseHandle GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime Sleep SetStdHandle FlushFileBuffers RtlUnwind HeapSize LCMapStringW MultiByteToWideChar CreateFileW

user32

CharUpperA CharUpperBuffA

gdi32

GetTextFaceA

advapi32

RevertToSelf

winhttp

WinHttpWriteData