file[.]exe | Triage™

General

Target
file.exe
Size 167KB
Sample231028-2bb9tafd54
SHA256 a85528d4fcbc101d6c0fc37aad3e1859ad6e8a2556883900627f5e5f455f4f0d
MD5 5a304c2394b24b25b7a2a75e8a21eca3
SHA1 ed122197e1f3638ac477d223945fd4d54f1bf64e
SHA512 4ff0c15990262ca4e10b1e0c585043e54208c08e0e051e8897774a3d40b4572317d15c9d69589ebee216b3a4e95e5d982030d0bb9963cf3a37e43db5ffca8305
SSDEEP 3072:qpXxw2JIElz4pAbXSOT6+2Xpr70q+2VVL0LBqpHU3:+x1J/14aLS4YprVFVR088
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 167KB

file.exe

IMPHASH a75c932ec0688c10f7354ecf57fbb5b0
SHA256 a85528d4fcbc101d6c0fc37aad3e1859ad6e8a2556883900627f5e5f455f4f0d
MD5 5a304c2394b24b25b7a2a75e8a21eca3
SHA1 ed122197e1f3638ac477d223945fd4d54f1bf64e
SHA512 4ff0c15990262ca4e10b1e0c585043e54208c08e0e051e8897774a3d40b4572317d15c9d69589ebee216b3a4e95e5d982030d0bb9963cf3a37e43db5ffca8305
SSDEEP 3072:qpXxw2JIElz4pAbXSOT6+2Xpr70q+2VVL0LBqpHU3:+x1J/14aLS4YprVFVR088
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

21349

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetDefaultCommConfigA RemoveVectoredExceptionHandler FindFirstFileW FindFirstChangeNotificationW WriteConsoleInputW WriteConsoleOutputCharacterW lstrlenA GetModuleHandleExA GetConsoleAliasExesA AllocConsole IsBadHugeReadPtr GetProcessIoCounters MapUserPhysicalPages GetConsoleAliasA ZombifyActCtx SetConsoleScreenBufferSize WriteConsoleInputA AddConsoleAliasW GetNumaAvailableMemoryNode OpenSemaphoreA GetSystemDefaultLCID MoveFileWithProgressA GenerateConsoleCtrlEvent FindNextVolumeMountPointA GetConsoleAliasesA ReadConsoleW GetWindowsDirectoryA WaitNamedPipeW SetCommState GetDriveTypeA GetEnvironmentStrings GlobalAlloc AddRefActCtx GetVolumeInformationA LoadLibraryW CopyFileW _hread CreateEventA GetExitCodeProcess TransactNamedPipe GetFileAttributesW GlobalFix GetCompressedFileSizeA lstrcatA lstrlenW FindNextVolumeMountPointW GetStartupInfoW ReplaceFileA GetTempPathW GetShortPathNameA GetNamedPipeHandleStateW GetStartupInfoA GetLastError SetLastError ReadConsoleOutputCharacterA CreateConsoleScreenBuffer CreateNamedPipeA EnumSystemCodePagesW SetStdHandle VerLanguageNameW OpenWaitableTimerA UnhandledExceptionFilter AddAtomW RemoveDirectoryW FoldStringW GetModuleHandleA FatalExit FindNextFileW VirtualProtect GetCurrentDirectoryA CompareStringA GetFileTime QueryPerformanceFrequency GetShortPathNameW SetProcessShutdownParameters FindAtomW GetVolumeNameForVolumeMountPointW DeleteFileW ResetWriteWatch GetSystemTime EnumSystemLocalesW lstrcpyW AreFileApisANSI WriteConsoleW CloseHandle SetTimeZoneInformation DebugActiveProcess SetFilePointer FlushFileBuffers MoveFileA HeapAlloc HeapReAlloc GetCommandLineW HeapSetInformation EncodePointer DecodePointer IsProcessorFeaturePresent GetProcAddress GetModuleHandleW ExitProcess WriteFile GetStdHandle GetModuleFileNameW HeapCreate EnterCriticalSection LeaveCriticalSection SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess HeapFree FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RaiseException GetCPInfo GetACP GetOEMCP IsValidCodePage Sleep WideCharToMultiByte RtlUnwind HeapSize LCMapStringW MultiByteToWideChar GetStringTypeW GetConsoleCP GetConsoleMode CreateFileW

user32

CharUpperW

advapi32

AbortSystemShutdownA

winhttp

WinHttpReadData

Sharing