file[.]exe | Triage™

General

Target
file.exe
Size 268KB
Sample231009-qmskdsfb53
SHA256 42baf0d9105229ca324cb979bcd9fa893bd2585cb91a98c7406ef610b1e35291
MD5 412f2a790774bab54a808da285637606
SHA1 176df256acbaeae1d78076becaddbb9319d657ce
SHA512 2e9cc7d784c02fd06487760913785c15c23988d6412aeef62ff2293c62016d3d8b60efa692f4ee31349fd36fca4481aa0861986991420d853dc7ce9b4f94b220
SSDEEP 6144:vcLzuEPl/CBpmpCdgTiemAOGCNvLz1aGGr:vszuGZC3vX4YvXw
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

file.exe

.exe 268KB

file.exe

IMPHASH ccd971500e6b6446ec4def65a9719b08
SHA256 42baf0d9105229ca324cb979bcd9fa893bd2585cb91a98c7406ef610b1e35291
MD5 412f2a790774bab54a808da285637606
SHA1 176df256acbaeae1d78076becaddbb9319d657ce
SHA512 2e9cc7d784c02fd06487760913785c15c23988d6412aeef62ff2293c62016d3d8b60efa692f4ee31349fd36fca4481aa0861986991420d853dc7ce9b4f94b220
SSDEEP 6144:vcLzuEPl/CBpmpCdgTiemAOGCNvLz1aGGr:vszuGZC3vX4YvXw
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86

PE Signature issue

Digest

db:6c:f0:a3:97:f9:50:e3:15:db:42:f9:32:09:46:53:62:57:0b:e2:9c:bb:5a:01:8c:a0:9b:34:e2:c9:20:81

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Avast Software s.r.o.,O=Avast Software s.r.o.,L=Praha,C=CZ

Chains

Sep 19, 2023

CN=Avast Software s.r.o.,O=Avast Software s.r.o.,L=Praha,C=CZ

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Avast Software s.r.o.,O=Avast Software s.r.o.,L=Praha,C=CZ

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Avast Software s.r.o.,O=Avast Software s.r.o.,L=Praha,C=CZ

Serial Number

01:5a:6b:ec:4d:7f:54:9f:e5:25:c8:52:df:67:0e:13

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 16, 2023 - Jan 15, 2026

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

40238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ole32

CoGetObjectContext CoGetApartmentType

kernel32

GetCPInfo CreateFileW HeapSize FreeConsole RaiseException QueryPerformanceCounter QueryPerformanceFrequency CloseHandle WaitForSingleObjectEx Sleep GetCurrentThreadId GetExitCodeThread InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW WideCharToMultiByte MultiByteToWideChar GetStringTypeW InitOnceBeginInitialize InitOnceComplete GetLastError FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress EncodePointer DecodePointer LCMapStringEx WriteConsoleW InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW GetCurrentProcessId InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcess TerminateProcess ReadConsoleW RtlUnwind SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetCommandLineA GetCommandLineW HeapFree HeapAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

PE Signature issue

ole32

kernel32