file[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

file.exe
Size

251KB
MD5

14be53af83fa482be458bb963ab0375a
SHA1

932e2efaa79e98e7717f83c22ffd40a18d9f5202
SHA256

d66349fd06be15422c5e95e15be4e486cba94fd1339a370f0c8b3b90cef148d5
SHA512

677004f40ecb23c7dab0a94311d19e809d3626fd76cbf747e5f086e478e88314f47ebcaefde15d7ac05a9f411f08690e309ffe71882f75d5f5a5e1f49049bc3e
SSDEEP

3072:ZIm9JsLZlsFEF7SG1t0uQSMScAzaZfO+IWRMqT922y6BzukSkwhzjP7ah5WkV:gLTcEF7WRS4iqT92/6BzuAwhz/xk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

Files

file.exe
.exe windows:5 windows x86

b402c7220872217841e38133c9655d5b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTempFileNameW
FindFirstFileW
SetThreadContext
FindFirstChangeNotificationW
PeekNamedPipe
SetEndOfFile
LoadResource
SetConsoleTextAttribute
GetLogicalDriveStringsW
FreeEnvironmentStringsA
GetModuleHandleW
GetTickCount
GetConsoleAliasesLengthA
GetDateFormatA
ReadConsoleInputA
GetFileAttributesA
FileTimeToSystemTime
CreateFileW
GlobalUnlock
GetShortPathNameA
GetLastError
GetProcAddress
VirtualAlloc
BackupWrite
LoadLibraryA
CreateHardLinkW
SetFileApisToANSI
BeginUpdateResourceA
OpenJobObjectW
FoldStringA
FindFirstVolumeA
ReadConsoleOutputCharacterW
HeapSize
GetLocaleInfoA
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
MultiByteToWideChar
GetStartupInfoW
RaiseException
RtlUnwind
HeapAlloc
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapReAlloc
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
LCMapStringA
WideCharToMultiByte
LCMapStringW
GetStringTypeA
GetStringTypeW

user32

ChangeMenuW
GetKeyNameTextA
GetClassInfoExA
GetMessageExtraInfo
LoadBitmapA
GetParent
LoadMenuA
DdeQueryStringW
CopyIcon
FlashWindow
CharToOemBuffW

Sections

.text
Size: 191KB - Virtual size: 190KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 28.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b402c7220872217841e38133c9655d5b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

Sections

.text Size: 191KB - Virtual size: 190KB

.data Size: 9KB - Virtual size: 28.3MB

.rsrc Size: 18KB - Virtual size: 18KB

.reloc Size: 31KB - Virtual size: 31KB

.text
Size: 191KB - Virtual size: 190KB

.data
Size: 9KB - Virtual size: 28.3MB

.rsrc
Size: 18KB - Virtual size: 18KB

.reloc
Size: 31KB - Virtual size: 31KB