file[.]exe | Triage™

General

Target
file.exe
Size 179KB
Sample231023-e7nw6afh64
SHA256 d6bc2b0f5899b66f3e21c6f8616c02aa218b6fbf292e9131da0414badacfe62e
MD5 6157fb913b1e40626c2720afe8776a83
SHA1 0ceb60a16d50e62d6f39b41535cfbf11c21b02f6
SHA512 43583a812fbb286b3cc9c3c92e0058a306b1388b3cddfbc7df61aeabd0d27bd30ef3eb1e40e5d1031c5e4b3761dfe43ee77633b34d49eacc44056baa478401ba
SSDEEP 3072:jyBNbfK6eAucOTXxZVVBkK7hHpxUkrOj9qdkoMuBX:iMnAunTX/VVjvxUW/k
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 179KB

file.exe

IMPHASH 8ea5db4b889f56362e73547d3beef0d3
SHA256 d6bc2b0f5899b66f3e21c6f8616c02aa218b6fbf292e9131da0414badacfe62e
MD5 6157fb913b1e40626c2720afe8776a83
SHA1 0ceb60a16d50e62d6f39b41535cfbf11c21b02f6
SHA512 43583a812fbb286b3cc9c3c92e0058a306b1388b3cddfbc7df61aeabd0d27bd30ef3eb1e40e5d1031c5e4b3761dfe43ee77633b34d49eacc44056baa478401ba
SSDEEP 3072:jyBNbfK6eAucOTXxZVVBkK7hHpxUkrOj9qdkoMuBX:iMnAunTX/VVjvxUW/k
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

24133

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetDefaultCommConfigA FindResourceA GetModuleHandleExA GetDriveTypeW CommConfigDialogA WriteConsoleOutputCharacterA GetEnvironmentStringsW WriteConsoleInputA SetComputerNameW UnlockFileEx GenerateConsoleCtrlEvent GetConsoleAliasesA GetConsoleAliasExesW WaitNamedPipeW GlobalAlloc LoadLibraryW GetLocaleInfoW CopyFileW SetConsoleCP GetConsoleAliasW GetWriteWatch GetFileAttributesW ReplaceFileW ReadFile GetCompressedFileSizeA FindNextVolumeMountPointW GetStartupInfoW SetConsoleTitleA DeactivateActCtx GetShortPathNameA GetStartupInfoA FindFirstFileA GetLastError SetLastError ReadConsoleOutputCharacterA GetCommandLineW VerLanguageNameA CreateNamedPipeA SetVolumeLabelW MoveFileW RemoveDirectoryA CopyFileA EnumSystemCodePagesW FreeUserPhysicalPages GetTempFileNameA GetProcessVersion FindClose AddAtomW CreateEventW HeapLock GetCommMask SetThreadIdealProcessor SetCommMask FoldStringA GetSystemInfo FindNextFileA GetModuleHandleA GetCommTimeouts lstrcatW VirtualProtect QueryPerformanceFrequency PeekConsoleInputA OpenSemaphoreW ReadConsoleInputW GetWindowsDirectoryW MoveFileWithProgressW GlobalAddAtomW EnumSystemLocalesW lstrcpyW DeleteFileA WriteConsoleW FlushFileBuffers AttachConsole GetVolumeNameForVolumeMountPointA SetStdHandle WideCharToMultiByte HeapFree HeapAlloc GetProcAddress GetModuleHandleW ExitProcess DecodePointer HeapReAlloc HeapSetInformation IsProcessorFeaturePresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess HeapCreate EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection WriteFile GetModuleFileNameW CloseHandle FreeEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringW MultiByteToWideChar GetStringTypeW Sleep SetFilePointer GetConsoleCP GetConsoleMode RaiseException RtlUnwind HeapSize CreateFileW

user32

CharUpperW

advapi32

AbortSystemShutdownW

winhttp

WinHttpReadData

Sharing