file[.]exe | Triage™

General

Target
file.exe
Size 174KB
Sample231024-mc32lacb8v
SHA256 93daff65c57117fbfd0f81b0f756f547467dfb09a0dc4952d0c8013ab6558bee
MD5 cdbff335d0d94a84af20e24c9ae1d36b
SHA1 8af1e2f5b1e515e7992813d6812a67599dc5d47d
SHA512 b43234638a4496293f6be1545181bb0f5b9b64cf01ca2fcb477f32edf03784a8c5a37f2907c73ab5d8207e2c623e31f9ecd63a9218a1716816a47426575170b0
SSDEEP 3072:a6BNVhdn8doyQJWO/3mr8Wjbfpj3A9P1yVVwXtih5J0h:x/hFSoyQJWO/308ibR3A9cwXti
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 174KB

file.exe

IMPHASH 496fa8e4f26e876e3283782f3600d997
SHA256 93daff65c57117fbfd0f81b0f756f547467dfb09a0dc4952d0c8013ab6558bee
MD5 cdbff335d0d94a84af20e24c9ae1d36b
SHA1 8af1e2f5b1e515e7992813d6812a67599dc5d47d
SHA512 b43234638a4496293f6be1545181bb0f5b9b64cf01ca2fcb477f32edf03784a8c5a37f2907c73ab5d8207e2c623e31f9ecd63a9218a1716816a47426575170b0
SSDEEP 3072:a6BNVhdn8doyQJWO/3mr8Wjbfpj3A9P1yVVwXtih5J0h:x/hFSoyQJWO/308ibR3A9cwXti
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

24682

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindResourceA FindFirstFileW WriteConsoleInputW lstrlenA GetDriveTypeW CommConfigDialogA WriteConsoleOutputCharacterA GetConsoleAliasA GetCurrentActCtx SetDefaultCommConfigW GetModuleHandleExW WriteConsoleInputA SetComputerNameW OpenSemaphoreA GetSystemDefaultLCID _lclose CreateNamedPipeW GenerateConsoleCtrlEvent FindNextVolumeMountPointA GetConsoleAliasesA GetConsoleAliasExesW WaitNamedPipeW GetCommandLineA GetEnvironmentStrings GlobalAlloc LoadLibraryW GetLocaleInfoW _hread EnumSystemCodePagesA GetConsoleAliasW GetWriteWatch GetFileAttributesW ReplaceFileW ReadFile GetCompressedFileSizeA QueryInformationJobObject lstrlenW GetStartupInfoW SetConsoleTitleA GetTempFileNameW GetLastError GetCurrentDirectoryW SetLastError ReadConsoleOutputCharacterA AttachConsole VerLanguageNameA CreateNamedPipeA SetVolumeLabelW CopyFileA EnumSystemCodePagesW FreeUserPhysicalPages GetProcessVersion FindClose UnhandledExceptionFilter MoveFileA AddAtomW CreateEventW RemoveDirectoryW GetCommMask SetThreadIdealProcessor SetCommMask FindAtomA FoldStringA GetSystemInfo FindNextFileA GetModuleHandleA GetCommTimeouts lstrcatW VirtualProtect CompareStringA QueryPerformanceFrequency PeekConsoleInputA GetShortPathNameW ReadConsoleInputW GetWindowsDirectoryW MoveFileWithProgressW GlobalAddAtomW DeleteFileA lstrcpyA EnumSystemLocalesA GetVolumeNameForVolumeMountPointA CreateFileW WriteConsoleW WideCharToMultiByte HeapFree HeapAlloc GetProcAddress GetModuleHandleW ExitProcess DecodePointer EncodePointer HeapReAlloc GetCommandLineW HeapSetInformation IsProcessorFeaturePresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess HeapCreate EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection WriteFile GetModuleFileNameW Sleep HeapSize CloseHandle FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringW MultiByteToWideChar GetStringTypeW SetFilePointer GetConsoleCP GetConsoleMode RaiseException RtlUnwind SetStdHandle FlushFileBuffers

user32

CharUpperW

advapi32

AbortSystemShutdownW

winhttp

WinHttpWriteData

Sharing