file[.]exe | Triage™

General

Target
file.exe
Size 180KB
Sample231026-va4jcaeg97
SHA256 54cbdd7ff4d1839f292e7cde1d17cb42d3a7d375993db9538f2cd9f6c0c68004
MD5 d426f4636979fdd11d74242f9df94c44
SHA1 4580b8cf94802e8ee95b558c733db1e8e819cb1b
SHA512 007f31dd14a072fcc16e8615cba59755e0a75674748e90390dbda654d189ba4d1d0676a19c4931852f4701023c27af91a7d8ba9aa51e11ddb3021cb19647f266
SSDEEP 3072:rHBNLcK8tUcsH4CxxDYVTnr0CSGM0UP80vsfek3abVZxssD+pGQex:t5cz4H4CDYVTrI3wnqbV3sM+pG
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 180KB

file.exe

IMPHASH 4231872410651d8504d1d45976ad591d
SHA256 54cbdd7ff4d1839f292e7cde1d17cb42d3a7d375993db9538f2cd9f6c0c68004
MD5 d426f4636979fdd11d74242f9df94c44
SHA1 4580b8cf94802e8ee95b558c733db1e8e819cb1b
SHA512 007f31dd14a072fcc16e8615cba59755e0a75674748e90390dbda654d189ba4d1d0676a19c4931852f4701023c27af91a7d8ba9aa51e11ddb3021cb19647f266
SSDEEP 3072:rHBNLcK8tUcsH4CxxDYVTnr0CSGM0UP80vsfek3abVZxssD+pGQex:t5cz4H4CDYVTrI3wnqbV3sM+pG
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

23762

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetVolumeNameForVolumeMountPointA GetTempFileNameW SetVolumeLabelA SetDefaultCommConfigA FindResourceA WriteConsoleInputW WriteConsoleOutputCharacterW lstrlenA GetModuleHandleExA GetLocaleInfoA SetLocalTime CommConfigDialogA MapUserPhysicalPages GlobalAddAtomA GetConsoleAliasA ZombifyActCtx SetHandleInformation SetConsoleScreenBufferSize WriteConsoleInputA OpenSemaphoreA GetSystemDefaultLCID _lclose GetModuleHandleW CreateNamedPipeW FindNextVolumeMountPointA GetConsoleAliasesA GetWindowsDirectoryA GetConsoleAliasExesW WaitNamedPipeW SetCommState GetCommandLineA SetCommTimeouts GetDriveTypeA GetEnvironmentStrings LoadLibraryW CopyFileW _hread GetExitCodeProcess GetConsoleAliasW GetFileAttributesW ReadFile GetCompressedFileSizeA CompareStringW lstrlenW GetStartupInfoW ReplaceFileA GetStartupInfoA GetLastError GetCurrentDirectoryW SetLastError AttachConsole VerLanguageNameA CreateNamedPipeA RemoveDirectoryA CopyFileA EnumSystemCodePagesW SetComputerNameA UnhandledExceptionFilter LocalAlloc SetConsoleCtrlHandler AddAtomW CreateEventW FoldStringW FindNextFileA SetConsoleTitleW GetModuleHandleA GetProcessShutdownParameters GetCommTimeouts lstrcatW FatalExit FindNextFileW VirtualProtect GetFileTime GetConsoleCursorInfo QueryPerformanceFrequency GetShortPathNameW TerminateJobObject FindAtomW MoveFileWithProgressW ResetWriteWatch ReadConsoleOutputCharacterW EnumSystemLocalesW DeleteFileA lstrcpyA HeapSize WideCharToMultiByte HeapAlloc HeapReAlloc GetCommandLineW HeapSetInformation IsProcessorFeaturePresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage EncodePointer TlsAlloc TlsGetValue TlsSetValue DecodePointer TlsFree GetCurrentThreadId GetProcAddress SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection ExitProcess WriteFile GetModuleFileNameW HeapCreate HeapFree CloseHandle FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringW MultiByteToWideChar GetStringTypeW Sleep SetFilePointer GetConsoleCP GetConsoleMode RaiseException RtlUnwind SetStdHandle FlushFileBuffers WriteConsoleW CreateFileW

user32

CharUpperW

winhttp

WinHttpWriteData

Sharing