file[.]exe | Triage™

General

Target
file.exe
Size 175KB
Sample231024-vy912agg7z
SHA256 5e839ab11a3cb5e8a054700533530ad29a4598cfbc645a300ba98824939d4ecc
MD5 a1378d0ef983ea3f941becf96876485f
SHA1 e8c24651d7ee5ee3dd8261ce5703b11292759a25
SHA512 673e2059a5c16182c7b85565916b26edfa060bcd1f3ed1cebd47e38ce9c14707545229992b5795fe6f5585adb2205acc2329faadb9515021a891bc998e477225
SSDEEP 3072:0HBNTT5X1xoc5aOD3mb+0/JYDTyfq8Izqk1r5Lbe75wVOGi7K:kpTpboc5aOD3s5/JcLe4lLS5wI
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 175KB

file.exe

IMPHASH 14847603ce0b1d0fbb55d8f9c5541c97
SHA256 5e839ab11a3cb5e8a054700533530ad29a4598cfbc645a300ba98824939d4ecc
MD5 a1378d0ef983ea3f941becf96876485f
SHA1 e8c24651d7ee5ee3dd8261ce5703b11292759a25
SHA512 673e2059a5c16182c7b85565916b26edfa060bcd1f3ed1cebd47e38ce9c14707545229992b5795fe6f5585adb2205acc2329faadb9515021a891bc998e477225
SSDEEP 3072:0HBNTT5X1xoc5aOD3mb+0/JYDTyfq8Izqk1r5Lbe75wVOGi7K:kpTpboc5aOD3s5/JcLe4lLS5wI
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

24682

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindFirstFileW WriteConsoleOutputCharacterW lstrlenA GetLocaleInfoA SetLocalTime GetDriveTypeW CommConfigDialogA MapUserPhysicalPages GetConsoleAliasA GetCurrentActCtx SetDefaultCommConfigW GetModuleHandleExW WriteConsoleInputA OpenSemaphoreA GetSystemDefaultLCID _lclose CreateNamedPipeW GenerateConsoleCtrlEvent FindNextVolumeMountPointA GetConsoleAliasesA GetWindowsDirectoryA GetCompressedFileSizeW GetConsoleAliasExesW WaitNamedPipeW GetCommandLineA GetEnvironmentStrings LoadLibraryW CopyFileW _hread EnumSystemCodePagesA GetFileAttributesW ReplaceFileW ReadFile QueryInformationJobObject CompareStringW lstrlenW FindResourceA SetConsoleTitleA GetShortPathNameA EnumSystemLocalesA GetLastError GetCurrentDirectoryW SetLastError ReadConsoleOutputCharacterA AttachConsole VerLanguageNameA SetVolumeLabelW RemoveDirectoryA CopyFileA SetComputerNameA GetProcessVersion UnhandledExceptionFilter LocalAlloc MoveFileA CreateEventW GetCommMask SetThreadIdealProcessor AddAtomA FoldStringW FindNextFileA GetModuleHandleA GetCommTimeouts lstrcatW VirtualProtect GetFileTime QueryPerformanceFrequency ReadConsoleInputW FindAtomW MoveFileWithProgressW GlobalAddAtomW ResetWriteWatch DeleteFileA lstrcpyA CreateFileW GetStartupInfoW GetTempFileNameW WriteConsoleW FlushFileBuffers WideCharToMultiByte HeapFree HeapAlloc GetProcAddress GetModuleHandleW ExitProcess DecodePointer EncodePointer HeapReAlloc GetCommandLineW HeapSetInformation IsProcessorFeaturePresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess HeapCreate EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection WriteFile GetModuleFileNameW Sleep HeapSize CloseHandle FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringW MultiByteToWideChar GetStringTypeW SetFilePointer GetConsoleCP GetConsoleMode RaiseException RtlUnwind SetStdHandle

user32

CharUpperW

advapi32

AbortSystemShutdownA

winhttp

WinHttpWriteData

Sharing