file[.]exe | Triage™

General

Target
file.exe
Size 178KB
Sample231022-tkmg5scd63
SHA256 e8d1c4f4cea682bee4ba4105f14bab0f6bcec51727080e1bc76993fa82f214fa
MD5 78849e44d5744bc62cf70d63e7798e49
SHA1 2acc897a1362d95e8ca76c06120b357ae700c388
SHA512 95daef07315270981b650d0beb27922f109ae93e8ba20222197ebc0d25bf7c6bb94e4b82496813461a93f2c9185b9ce87c3b448d8a0556579db2ca3e7419cac5
SSDEEP 3072:yyBNcfOg6AMoKASlflSBoi1dNoqI6WjPauFG1AzfCWUjdjBvJiQX:ZNdAMfASFWdoqIdraoGizXsj
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 178KB

file.exe

IMPHASH d2a54e4207f7fb1f334f58a667aa3417
SHA256 e8d1c4f4cea682bee4ba4105f14bab0f6bcec51727080e1bc76993fa82f214fa
MD5 78849e44d5744bc62cf70d63e7798e49
SHA1 2acc897a1362d95e8ca76c06120b357ae700c388
SHA512 95daef07315270981b650d0beb27922f109ae93e8ba20222197ebc0d25bf7c6bb94e4b82496813461a93f2c9185b9ce87c3b448d8a0556579db2ca3e7419cac5
SSDEEP 3072:yyBNcfOg6AMoKASlflSBoi1dNoqI6WjPauFG1AzfCWUjdjBvJiQX:ZNdAMfASFWdoqIdraoGizXsj
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

24149

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WriteConsoleInputW GetModuleHandleExA GetConsoleAliasExesA GetDriveTypeW CommConfigDialogA WriteConsoleOutputCharacterA FindResourceW GetEnvironmentStringsW WriteConsoleInputA SetComputerNameW UnlockFileEx GenerateConsoleCtrlEvent WaitNamedPipeW GetCommandLineA GlobalAlloc LoadLibraryW GetLocaleInfoW CopyFileW SetConsoleCP GetConsoleAliasW GetWriteWatch GetFileAttributesW ReplaceFileW ReadFile GetCompressedFileSizeA FindNextVolumeMountPointW SetConsoleTitleA DeactivateActCtx GetShortPathNameA GetConsoleAliasesW GetStartupInfoA FindFirstFileA GetLastError SetLastError SetDefaultCommConfigA VerLanguageNameA SetVolumeLabelW MoveFileW RemoveDirectoryA CopyFileA EnumSystemCodePagesW FreeUserPhysicalPages GetTempFileNameA GetProcessVersion FindClose AddAtomW CreateEventW HeapLock GetCommMask SetThreadIdealProcessor FoldStringA GetSystemInfo FindNextFileA GetModuleHandleA GetCommTimeouts lstrcatW FindNextFileW VirtualProtect QueryPerformanceFrequency PeekConsoleInputA OpenSemaphoreW ReadConsoleInputW GetWindowsDirectoryW MoveFileWithProgressW GlobalAddAtomW EnumSystemLocalesW lstrcpyW DeleteFileA WriteConsoleW CreateFileW ReadConsoleOutputCharacterA GetVolumeNameForVolumeMountPointA FlushFileBuffers SetStdHandle WideCharToMultiByte HeapFree HeapAlloc GetProcAddress GetModuleHandleW ExitProcess DecodePointer HeapReAlloc GetCommandLineW HeapSetInformation GetStartupInfoW IsProcessorFeaturePresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess HeapCreate EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection WriteFile GetModuleFileNameW CloseHandle FreeEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringW MultiByteToWideChar GetStringTypeW Sleep SetFilePointer GetConsoleCP GetConsoleMode RaiseException RtlUnwind HeapSize

user32

CharUpperW

advapi32

AbortSystemShutdownW

winhttp

WinHttpReadData

Sharing