mal[.]exe | Triage™

General

Target
mal.exe
Size 3.2MB
Sample231012-v9956sha28
SHA256 001405ded84e227092bafe165117888d423719d7d75554025ec410d1d6558925
MD5 cd2eb880ecbad847cb6205a42708e5e4
SHA1 aadaba5e4d887136cbcb3df0a4dc0eb94f391585
SHA512 b0591d6e4181275001fdefb70e04bdeb1b241dc696a887f36375826904bc164714bfe5d0b86e39952f877309571b9a0212ca5e5f122c6393cb17a797b0c2f8b2
SSDEEP 49152:Ww/9l48pPUbkSv5TCcLhAKFEl3In1bnkpisogrpu4r+3qwsi:WcfUbZGcLMIn1Lkp3lrpuh8i
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mal.exe

File Explorer

mal.exe

.exe 3.2MB

mal.exe

IMPHASH 712aa83f8950b5fd92fb1500326938ba
SHA256 001405ded84e227092bafe165117888d423719d7d75554025ec410d1d6558925
MD5 cd2eb880ecbad847cb6205a42708e5e4
SHA1 aadaba5e4d887136cbcb3df0a4dc0eb94f391585
SHA512 b0591d6e4181275001fdefb70e04bdeb1b241dc696a887f36375826904bc164714bfe5d0b86e39952f877309571b9a0212ca5e5f122c6393cb17a797b0c2f8b2
SSDEEP 49152:Ww/9l48pPUbkSv5TCcLhAKFEl3In1bnkpisogrpu4r+3qwsi:WcfUbZGcLMIn1Lkp3lrpuh8i
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

2444555

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

ntdll

NtCancelIoFileEx RtlCaptureContext NtDeviceIoControlFile RtlNtStatusToDosError RtlUnwind

advapi32

SystemFunction036

kernel32

SetFilePointerEx CreateFileW DecodePointer GetProcessHeap GetCurrentProcess GetVersion GetCommandLineA GetTickCount GetLastError GetEnvironmentStrings HeapAlloc HeapFree HeapReAlloc AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection ReleaseSRWLockExclusive AddVectoredExceptionHandler SetThreadStackGuarantee GetSystemInfo CreateThread CloseHandle VirtualAlloc SetLastError GetFinalPathNameByHandleW GetQueuedCompletionStatusEx Sleep GetModuleHandleA GetProcAddress TlsGetValue TlsSetValue AcquireSRWLockShared ReleaseSRWLockShared GetEnvironmentVariableW GetStdHandle GetConsoleMode WriteFile WriteConsoleW GetCurrentDirectoryW GetCurrentThread ReleaseMutex WaitForSingleObjectEx LoadLibraryA CreateMutexA TlsAlloc GetModuleHandleW FormatMessageW InitializeCriticalSection TryEnterCriticalSection QueryPerformanceCounter QueryPerformanceFrequency CreateIoCompletionPort PostQueuedCompletionStatus SwitchToThread WaitForSingleObject FlushFileBuffers GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsFree FreeLibrary LoadLibraryExW RaiseException GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW CompareStringW LCMapStringW HeapSize GetConsoleCP

Sharing