file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 5.5MB
Sample231010-ldl9sscd9x
SHA256 5a5a5ebdbcaac1a77e3b8aa6f439b37080c17076934930121601bb4e78b6dc8a
MD5 a4ae0ede0423659b0e0fa54bb7a72dff
SHA1 51621600acfd50cdfa029d4a71f60bd1d84f89a7
SHA512 72a4c4370446232dd32d94bbad581e2fde351e71bdce02ce13b1cb45fc0ad892f13de262b2901f0ea9b0ec1f3b3c1b6c5fcf8487396a2d855fa247c16cecd944
SSDEEP 49152:fpi8VPYwNW/Fg1mJyRXL68HID3higFPt+6wODn24bd/WbISiAtA7VN56k136hRh5:Qu9iDwanRp/Wb7I7fd6R/RYlNS3
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 5.5MB

file.exe

IMPHASH 8b609662a1bb2ab7e471e49c70dcc22f
SHA256 5a5a5ebdbcaac1a77e3b8aa6f439b37080c17076934930121601bb4e78b6dc8a
MD5 a4ae0ede0423659b0e0fa54bb7a72dff
SHA1 51621600acfd50cdfa029d4a71f60bd1d84f89a7
SHA512 72a4c4370446232dd32d94bbad581e2fde351e71bdce02ce13b1cb45fc0ad892f13de262b2901f0ea9b0ec1f3b3c1b6c5fcf8487396a2d855fa247c16cecd944
SSDEEP 49152:fpi8VPYwNW/Fg1mJyRXL68HID3higFPt+6wODn24bd/WbISiAtA7VN56k136hRh5:Qu9iDwanRp/Wb7I7fd6R/RYlNS3
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

437644

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

EventActivityIdControl EnumerateTraceGuidsEx EventSetInformation EventUnregister RegCloseKey EventRegister EventWriteTransfer RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegQueryValueExW OpenProcessToken GetTokenInformation DuplicateTokenEx OpenThreadToken RevertToSelf ImpersonateLoggedOnUser CheckTokenMembership LookupPrivilegeValueW AdjustTokenPrivileges RegCreateKeyExW RegDeleteValueW RegSetValueExW EventWrite EventEnabled

ncrypt

BCryptCloseAlgorithmProvider BCryptSetProperty BCryptOpenAlgorithmProvider BCryptDestroyKey BCryptDecrypt BCryptImportKey BCryptEncrypt BCryptGenRandom

kernel32

TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RaiseException RtlPcToFileHeader CloseThreadpoolIo ExitProcess GetCurrentProcessId MultiByteToWideChar GetStdHandle TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToSystemTime GetSystemTime GetCalendarInfoEx CompareStringOrdinal CompareStringEx FindNLSStringEx GetLocaleInfoEx ResolveLocaleName LCIDToLocaleName GetUserPreferredUILanguages FindStringOrdinal GetTickCount64 GetCurrentProcessorNumber GetCurrentProcess GetCurrentThread WaitForSingleObject Sleep CreateThreadpoolWork CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CloseThreadpoolWait InitializeCriticalSection InitializeConditionVariable DeleteCriticalSection LocalFree EnterCriticalSection SleepConditionVariableCS LeaveCriticalSection WakeConditionVariable WaitForMultipleObjectsEx GetLastError SetLastError GetFullPathNameW GetLongPathNameW WideCharToMultiByte LocalAlloc GetConsoleOutputCP GetProcAddress RaiseFailFastException CreateThreadpoolIo StartThreadpoolIo CancelThreadpoolIo LocaleNameToLCID LCMapStringEx EnumTimeFormatsEx EnumCalendarInfoExEx CopyFileExW CreateFileW DeleteFileW DeviceIoControl ExpandEnvironmentStringsW FindClose FindFirstFileExW FlushFileBuffers FreeLibrary GetCurrentDirectoryW GetFileAttributesExW GetFileInformationByHandleEx GetFileType GetModuleFileNameW GetOverlappedResult GetSystemDirectoryW GetTempFileNameW LoadLibraryExW OutputDebugStringW ReadFile SetFileInformationByHandle SetFilePointerEx SetThreadErrorMode CreateThread ResumeThread DuplicateHandle GetThreadPriority SetThreadPriority GetDynamicTimeZoneInformation GetTimeZoneInformation WriteFile CloseHandle SetEvent CreateEventExW GetEnvironmentVariableW FormatMessageW K32EnumProcessModulesEx IsWow64Process GetExitCodeProcess CreateProcessW TerminateProcess OpenProcess K32EnumProcesses K32GetModuleInformation K32GetModuleBaseNameW K32GetModuleFileNameExW GetProcessId CreatePipe GetCPInfoExW GetConsoleCP CreateFileA HeapFree GetProcessHeap HeapAlloc LoadLibraryA VirtualProtect VirtualAllocEx FlushProcessWriteBuffers GetCurrentThreadId QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx RtlCaptureContext RtlRestoreContext AddVectoredExceptionHandler FlsAlloc FlsGetValue FlsSetValue CreateEventW SwitchToThread SuspendThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualFree QueryInformationJobObject GetModuleHandleW GetModuleHandleExW GetProcessAffinityMask InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask VirtualQuery InitializeCriticalSectionEx GetSystemTimeAsFileTime ResetEvent DebugBreak SleepEx GlobalMemoryStatusEx GetSystemInfo GetTickCount GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock GetWriteWatch ResetWriteWatch VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo RtlUnwindEx IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry InitializeSListHead SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive

ole32

CoTaskMemFree CoCreateGuid CoGetApartmentType CoUninitialize CoInitializeEx CoWaitForMultipleHandles CoTaskMemAlloc

user32

LoadStringW

api-ms-win-crt-heap-l1-1-0

_callnewh calloc malloc free _set_new_mode

api-ms-win-crt-math-l1-1-0

floor pow sin tan __setusermatherr cos modf ceil

api-ms-win-crt-string-l1-1-0

strncpy_s _stricmp strcpy_s _wcsicmp strcmp wcsncmp

api-ms-win-crt-runtime-l1-1-0

_initterm_e exit _get_initial_wide_environment terminate _crt_atexit _register_onexit_function _initialize_onexit_table abort _initterm _initialize_wide_environment _configure_wide_argv _register_thread_local_exe_atexit_callback _c_exit _cexit __p___wargv _set_app_type __p___argc _seh_filter_exe _exit

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf __stdio_common_vsscanf _set_fmode __p__commode __acrt_iob_func __stdio_common_vsprintf_s

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

464KB

Virtual Size

464KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

213KB

Virtual Size

284KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

157KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

93KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ