file[.]exe | Triage™

General

Target
file.exe
Size 178KB
Sample231025-avmfcacc25
SHA256 1c1062e65701fdea8fa0eca0884f974b8c9e6cfe70391dfc33fcbf5594b1ebf8
MD5 27695c4b9737a5cf0fcd78604e2b9292
SHA1 7c87761be8d70236c80c4780f633241557ec9088
SHA512 351a8c394ce34f3305b63dbc759d9af17dba688b3c6a153d6c58df7ce2184f31384121728c73c266a1be950bec7dcbfb5d8df1445282209c8ef0d096bdf7dc17
SSDEEP 3072:yHBN7RxrIuql08tXVNr3Eip/ONA9xv7C+aEwK+tGIpxFxl:iH5jE08tXVNr1p20JCGw/tGS
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 178KB

file.exe

IMPHASH 4a29bea1f6157bee80d443c8ac974ac6
SHA256 1c1062e65701fdea8fa0eca0884f974b8c9e6cfe70391dfc33fcbf5594b1ebf8
MD5 27695c4b9737a5cf0fcd78604e2b9292
SHA1 7c87761be8d70236c80c4780f633241557ec9088
SHA512 351a8c394ce34f3305b63dbc759d9af17dba688b3c6a153d6c58df7ce2184f31384121728c73c266a1be950bec7dcbfb5d8df1445282209c8ef0d096bdf7dc17
SSDEEP 3072:yHBN7RxrIuql08tXVNr3Eip/ONA9xv7C+aEwK+tGIpxFxl:iH5jE08tXVNr1p20JCGw/tGS
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

24162

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetVolumeNameForVolumeMountPointA GetTempFileNameW FindResourceA FindFirstFileW WriteConsoleOutputCharacterW lstrlenA GetModuleHandleExA GetLocaleInfoA SetLocalTime CommConfigDialogA MapUserPhysicalPages GlobalAddAtomA GetConsoleAliasA GetCurrentActCtx SetDefaultCommConfigW WriteConsoleInputA OpenSemaphoreA GetSystemDefaultLCID _lclose CreateNamedPipeW FindNextVolumeMountPointA GetConsoleAliasesA GetWindowsDirectoryA GetConsoleAliasExesW WaitNamedPipeW GetCommandLineA SetCommTimeouts GetDriveTypeA GetEnvironmentStrings LoadLibraryW CopyFileW _hread CreateEventA GetFileAttributesA GetExitCodeProcess EnumSystemCodePagesA ReplaceFileW ReadFile GetCompressedFileSizeA CompareStringW lstrlenW GetStartupInfoW SetConsoleTitleA GetShortPathNameA GetLastError GetCurrentDirectoryW SetLastError AttachConsole VerLanguageNameA SetVolumeLabelW RemoveDirectoryA CopyFileA SetComputerNameA GetProcessVersion UnhandledExceptionFilter LocalAlloc SetConsoleCtrlHandler GetCommMask SetThreadIdealProcessor AddAtomA FoldStringW FindNextFileA GetModuleHandleA GetCommTimeouts lstrcatW FindNextFileW VirtualProtect GetCurrentDirectoryA GetFileTime GetConsoleCursorInfo QueryPerformanceFrequency ReadConsoleInputW TerminateJobObject FindAtomW MoveFileWithProgressW ResetWriteWatch ReadConsoleOutputCharacterW EnumSystemLocalesW DeleteFileA lstrcpyA CreateFileW HeapSize WideCharToMultiByte HeapFree HeapAlloc HeapReAlloc GetCommandLineW HeapSetInformation IsProcessorFeaturePresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage EncodePointer TlsAlloc TlsGetValue TlsSetValue DecodePointer TlsFree GetModuleHandleW GetCurrentThreadId GetProcAddress SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess HeapCreate EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection ExitProcess WriteFile GetModuleFileNameW CloseHandle FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringW MultiByteToWideChar GetStringTypeW Sleep SetFilePointer GetConsoleCP GetConsoleMode RaiseException RtlUnwind SetStdHandle FlushFileBuffers WriteConsoleW

user32

CharUpperW

winhttp

WinHttpWriteData

Sharing