file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 2.9MB
Sample231016-gwf4aaeb34
SHA256 e08cf5870ce7c020103b4ebcd9afa9f07f2b2ec4214f8a743530cba20b4dfe75
MD5 3cf3b70ee3b7afb9a4ada4f865ba0a2e
SHA1 b539b9012803e0eaa8e6d2a73ec3475ffc6a401a
SHA512 bd6d4701f576b548080f994ab60bc9bcd4ba14cc144a22970b67bb06a692e0caa110a5ecb1ed470e72f40795e06f22ab8c6af8167541d62323eaf79792ebf64e
SSDEEP 49152:fVMgd4R3+lim5eY30w55yVC/XgFN7eEha3W:ysCRZ4m
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

file.exe

.exe 2.9MB

file.exe

IMPHASH a188770b4c5dc5c7e3cb93b455bd2b97
SHA256 e08cf5870ce7c020103b4ebcd9afa9f07f2b2ec4214f8a743530cba20b4dfe75
MD5 3cf3b70ee3b7afb9a4ada4f865ba0a2e
SHA1 b539b9012803e0eaa8e6d2a73ec3475ffc6a401a
SHA512 bd6d4701f576b548080f994ab60bc9bcd4ba14cc144a22970b67bb06a692e0caa110a5ecb1ed470e72f40795e06f22ab8c6af8167541d62323eaf79792ebf64e
SSDEEP 49152:fVMgd4R3+lim5eY30w55yVC/XgFN7eEha3W:ysCRZ4m
MD5 SHA1 SHA512 SSDEEP

PE Signature issue

Digest

c0:bc:a7:c3:03:55:1e:4e:62:fb:04:77:fb:16:dc:1b:af:56:14:35:26:b4:17:ba:e5:bb:b6:24:e1:24:c4:fd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Code Signing PCA 2011,OU=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 16, 2023

Minor OS version

Major OS version

Entry point

432452

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegQueryValueExW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges EventWrite EventRegister EventEnabled

bcrypt

BCryptCloseAlgorithmProvider BCryptSetProperty BCryptOpenAlgorithmProvider BCryptDestroyKey BCryptDecrypt BCryptImportKey BCryptEncrypt BCryptGenRandom

kernel32

TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RaiseException RtlPcToFileHeader SetLastError CreateProcessW GetLastError LocalFree LoadLibraryA GetProcAddress VirtualProtect VirtualAllocEx GetCurrentProcessId MultiByteToWideChar GetStdHandle TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToSystemTime GetSystemTime GetCalendarInfoEx CompareStringOrdinal CompareStringEx FindNLSStringEx GetLocaleInfoEx ResolveLocaleName GetUserPreferredUILanguages FindStringOrdinal GetTickCount64 GetCurrentProcessorNumber GetCurrentProcess GetCurrentThread Sleep InitializeCriticalSection InitializeConditionVariable DeleteCriticalSection EnterCriticalSection SleepConditionVariableCS LeaveCriticalSection WakeConditionVariable WaitForMultipleObjectsEx GetFullPathNameW GetLongPathNameW WideCharToMultiByte LocalAlloc GetConsoleOutputCP RaiseFailFastException LocaleNameToLCID LCMapStringEx EnumTimeFormatsEx EnumCalendarInfoExEx ExpandEnvironmentStringsW FindClose FindFirstFileExW FreeLibrary GetFileAttributesExW GetModuleFileNameW GetSystemDirectoryW LoadLibraryExW SetThreadErrorMode DuplicateHandle GetThreadPriority GetDynamicTimeZoneInformation GetTimeZoneInformation WriteFile CloseHandle SetEvent CreateEventExW GetEnvironmentVariableW FormatMessageW K32EnumProcessModulesEx IsWow64Process GetExitCodeProcess TerminateProcess OpenProcess K32EnumProcesses K32GetModuleInformation K32GetModuleBaseNameW K32GetModuleFileNameExW GetProcessId FlushProcessWriteBuffers QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId WaitForSingleObjectEx VirtualQuery RtlCaptureContext RtlRestoreContext AddVectoredExceptionHandler FlsAlloc FlsGetValue FlsSetValue CreateEventW SwitchToThread CreateThread SetThreadPriority SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualFree QueryInformationJobObject GetModuleHandleW GetModuleHandleExW GetProcessAffinityMask InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask InitializeCriticalSectionEx GetSystemTimeAsFileTime ResetEvent DebugBreak WaitForSingleObject SleepEx GlobalMemoryStatusEx GetSystemInfo GetTickCount GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock GetWriteWatch ResetWriteWatch VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo RtlUnwindEx IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry InitializeSListHead SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive

ole32

CoTaskMemFree CoCreateGuid CoGetApartmentType CoUninitialize CoInitializeEx CoWaitForMultipleHandles CoTaskMemAlloc

user32

LoadStringW

api-ms-win-crt-math-l1-1-0

sin tan modf __setusermatherr pow ceil cos floor

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode _callnewh calloc free

api-ms-win-crt-string-l1-1-0

wcsncmp _stricmp strcpy_s _wcsicmp strncpy_s strcmp

api-ms-win-crt-runtime-l1-1-0

_initterm_e exit _get_initial_wide_environment terminate _crt_atexit _register_onexit_function _initialize_onexit_table abort _initterm _initialize_wide_environment _configure_wide_argv _register_thread_local_exe_atexit_callback _c_exit _cexit __p___wargv _set_app_type __p___argc _seh_filter_exe _exit

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __stdio_common_vsprintf_s _set_fmode __stdio_common_vsscanf __p__commode __stdio_common_vfprintf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

457KB

Virtual Size

457KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

119KB

Virtual Size

175KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

106KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

956B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

57KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ