file[.]exe | Triage™

General

Target
file.exe
Size 458KB
Sample231008-mvhtdabd5v
SHA256 831e1887de32640a9d66dc993eba2c31a7e01f017f69051cc8b94e76fd4bf51d
MD5 9341d5d0405c6b78cf34d91817889c70
SHA1 67f6015ea547eb129b0a30218862f72b4d3780dd
SHA512 962add5b576b5943d12e1e7e8e6ff48f98c9fa6025c52c26461c6363b279315f1a464b8554664d6b440c21cb2eb573283466a91152b7a6d6c7baee22329f5d8e
SSDEEP 6144:EtIZZuKBhlfq1T9AgKnaAOT1oDxhDh54d/K0rgCLtLiwZEnpKfOZ:EtuZDBhhlaluDXh54d/KCgCLtLirYc
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

file.exe

.exe 458KB

file.exe

IMPHASH abd414d2e28dbea147f5fd75ae68918f
SHA256 831e1887de32640a9d66dc993eba2c31a7e01f017f69051cc8b94e76fd4bf51d
MD5 9341d5d0405c6b78cf34d91817889c70
SHA1 67f6015ea547eb129b0a30218862f72b4d3780dd
SHA512 962add5b576b5943d12e1e7e8e6ff48f98c9fa6025c52c26461c6363b279315f1a464b8554664d6b440c21cb2eb573283466a91152b7a6d6c7baee22329f5d8e
SSDEEP 6144:EtIZZuKBhlfq1T9AgKnaAOT1oDxhDh54d/K0rgCLtLiwZEnpKfOZ:EtuZDBhhlaluDXh54d/KCgCLtLirYc
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86

PE Signature issue

Digest

70:1e:3a:07:16:54:10:d3:c2:60:8b:bd:3d:a9:53:e3:e7:2c:e5:7b:21:72:af:08:df:d7:06:45:75:35:25:43

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=K Desktop Environment e.V.,O=K Desktop Environment e.V.,POSTALCODE=10969,STREET=Prinzenstr 85 F,L=Berlin,ST=Berlin,C=DE

Chains

Apr 27, 2022

CN=K Desktop Environment e.V.,O=K Desktop Environment e.V.,POSTALCODE=10969,STREET=Prinzenstr 85 F,L=Berlin,ST=Berlin,C=DE

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Minor OS version

0

Major OS version

6

Entry point

40552

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ole32

CoGetObjectContext CoGetApartmentType

advapi32

RegDisablePredefinedCacheEx

kernel32

HeapSize CreateFileW FreeConsole RaiseException CloseHandle WaitForSingleObjectEx GetCurrentThreadId InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW WideCharToMultiByte MultiByteToWideChar GetStringTypeW InitOnceBeginInitialize InitOnceComplete GetLastError FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceCounter EncodePointer DecodePointer LCMapStringEx GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress WriteConsoleW GetCPInfo InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcess TerminateProcess GetCurrentProcessId InitializeSListHead ReadConsoleW RtlUnwind SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapFree HeapAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle

Sharing