file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 288KB
Sample231008-ll2dpadd95
SHA256 141398e4cab2c24c9df53d19f3310a31c5edbc39e8dc64fec46003b2f6255f4e
MD5 854b5c0686fecd62735cfe962db1fd8e
SHA1 81b9c3d72043754056156694432f14be17da937f
SHA512 2d4eb10f2b4630dc52f3ba075a50e52431fd84f4579c766e3f80634dc247890e311bd2a727d2b186b5da973bb73799ce1dc50d9532b4cf2cbffb457adf90112f
SSDEEP 3072:ccSS88xWg9uov8/WK3OE+Mh+FGf41QuSA/a9:WS1WH+8//OET8ev
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 288KB

file.exe

IMPHASH 58b4037134287758faa5dc792dc5432b
SHA256 141398e4cab2c24c9df53d19f3310a31c5edbc39e8dc64fec46003b2f6255f4e
MD5 854b5c0686fecd62735cfe962db1fd8e
SHA1 81b9c3d72043754056156694432f14be17da937f
SHA512 2d4eb10f2b4630dc52f3ba075a50e52431fd84f4579c766e3f80634dc247890e311bd2a727d2b186b5da973bb73799ce1dc50d9532b4cf2cbffb457adf90112f
SSDEEP 3072:ccSS88xWg9uov8/WK3OE+Mh+FGf41QuSA/a9:WS1WH+8//OET8ev
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21950

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleExA CommConfigDialogA FindResourceW OpenJobObjectA InterlockedDecrement SetDefaultCommConfigW QueryPerformanceCounter GetEnvironmentStringsW InterlockedCompareExchange WriteConsoleInputA OpenSemaphoreA CreateHardLinkA SetTapeParameters SetThreadUILanguage FindNextVolumeMountPointA ConvertFiberToThread ReadConsoleW GetCompressedFileSizeW GetConsoleAliasExesW WaitNamedPipeW EnumTimeFormatsA WriteFile GetCommandLineA GetDriveTypeA GetVolumePathNameW FindResourceExA GetConsoleCP GlobalAlloc LoadLibraryW GetConsoleMode GetLocaleInfoW ReadConsoleInputA CopyFileW GetCalendarInfoA SetConsoleCP DeleteVolumeMountPointW InterlockedPopEntrySList GetFileAttributesA EnumSystemCodePagesA GetConsoleAliasesLengthW SetSystemPowerState IsDBCSLeadByte GetACP CreateMailslotW GetShortPathNameA GetNamedPipeHandleStateW GetConsoleAliasesW InterlockedExchange GetStartupInfoA GetLastError SetLastError ReadConsoleOutputCharacterA PeekConsoleInputW SetVolumeLabelW RemoveDirectoryA SetComputerNameA GetTempFileNameA FindClose GetAtomNameA SetCalendarInfoW MoveFileA SetConsoleCtrlHandler AddAtomA HeapWalk SetCommMask GetPrivateProfileSectionNamesA FindNextFileA EnumDateFormatsA GetModuleHandleA FreeEnvironmentStringsW GetStringTypeW VirtualProtect GetWindowsDirectoryW FindFirstVolumeW GetVolumeNameForVolumeMountPointW DeleteFileW AddConsoleAliasA ReadFile WriteConsoleW GetComputerNameA WriteConsoleInputW SetConsoleMode GetCommandLineW WideCharToMultiByte HeapFree HeapAlloc GetProcAddress GetModuleHandleW ExitProcess DecodePointer HeapReAlloc HeapSetInformation GetStartupInfoW RaiseException GetCPInfo InterlockedIncrement GetOEMCP IsValidCodePage EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess IsProcessorFeaturePresent HeapCreate GetStdHandle GetModuleFileNameW EnterCriticalSection LeaveCriticalSection SetFilePointer SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection CloseHandle GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringW MultiByteToWideChar Sleep SetStdHandle FlushFileBuffers RtlUnwind HeapSize CreateFileW

user32

CharUpperBuffA CharUpperW

gdi32

GetTextFaceA

advapi32

RevertToSelf

winhttp

WinHttpReadData