file[.]exe | Triage™

General

Target
file.exe
Size 167KB
Sample231028-aewn3sbe4w
SHA256 8d58024006a6c3503ba5af8f92dbdfd9178e27082491717ca1a2bdc35cf81b02
MD5 a666eac4d7ffb6c00bbc79b627e1c660
SHA1 ddfd94e60bdbf9a4a08e50a2a0a77e4d8d7c8fdf
SHA512 ed1fec4f3d268c2255fd76e59fc610da4fc04977da466ffd271dde466e49d263b1cd16af9663484cfdaf8c81092be51004d1fdee9ddc9eff5b5c35178bc15525
SSDEEP 3072:i4BNWDTQpQFduAuphybdpku3HWSXX+2JSb9pYDsqndUyDxajquSc:v64QFdNuphMTku3HR+2O9pY4oHo
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 167KB

file.exe

IMPHASH c2fdfbe7cd82d7389fba16b58a347547
SHA256 8d58024006a6c3503ba5af8f92dbdfd9178e27082491717ca1a2bdc35cf81b02
MD5 a666eac4d7ffb6c00bbc79b627e1c660
SHA1 ddfd94e60bdbf9a4a08e50a2a0a77e4d8d7c8fdf
SHA512 ed1fec4f3d268c2255fd76e59fc610da4fc04977da466ffd271dde466e49d263b1cd16af9663484cfdaf8c81092be51004d1fdee9ddc9eff5b5c35178bc15525
SSDEEP 3072:i4BNWDTQpQFduAuphybdpku3HWSXX+2JSb9pYDsqndUyDxajquSc:v64QFdNuphMTku3HR+2O9pY4oHo
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

21810

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetVolumeNameForVolumeMountPointA DebugActiveProcess SetDefaultCommConfigA RemoveVectoredExceptionHandler FindFirstFileW WriteConsoleInputW WriteConsoleOutputCharacterW lstrlenA GetModuleHandleExA GetLocaleInfoA AllocConsole GetProcessIoCounters MapUserPhysicalPages GlobalAddAtomA GetCommState WaitNamedPipeA ZombifyActCtx SetHandleInformation SetConsoleScreenBufferSize WriteConsoleInputA AddConsoleAliasW OpenSemaphoreA GetSystemDefaultLCID _lclose MoveFileWithProgressA GetModuleHandleW GenerateConsoleCtrlEvent FindNextVolumeMountPointA ReadConsoleW GetWindowsDirectoryA GetConsoleAliasExesW SetCommState GetCommandLineA GetDriveTypeA GetEnvironmentStrings GlobalAlloc AddRefActCtx LoadLibraryW ReadConsoleInputA CopyFileW _hread CreateEventA GetExitCodeProcess GetConsoleAliasW GetFileAttributesW GetCompressedFileSizeA lstrlenW GetStartupInfoW ReplaceFileA GetShortPathNameA GetConsoleAliasesW GetStartupInfoA SetThreadLocale GetLastError SetLastError ReadConsoleOutputCharacterA VerLanguageNameA CreateNamedPipeA CopyFileA EnumSystemCodePagesW SetStdHandle SetComputerNameA GetTempFileNameA OpenWaitableTimerA UnhandledExceptionFilter AddAtomW SetCurrentDirectoryW RemoveDirectoryW FoldStringW FindNextFileA GetModuleHandleA lstrcatW FatalExit FindNextFileW VirtualProtect GetCurrentDirectoryA CompareStringA GetFileTime GetConsoleCursorInfo QueryPerformanceFrequency SetProcessShutdownParameters Module32NextW FindAtomW GetTempPathA ResetWriteWatch GetSystemTime EnumSystemLocalesW CommConfigDialogW DeleteFileA lstrcpyA HeapSize WideCharToMultiByte HeapAlloc HeapReAlloc GetCommandLineW HeapSetInformation DecodePointer SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess GetCurrentProcess GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId GetProcAddress IsProcessorFeaturePresent ExitProcess WriteFile GetStdHandle GetModuleFileNameW HeapCreate EnterCriticalSection LeaveCriticalSection HeapFree CloseHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer GetConsoleCP GetConsoleMode Sleep LCMapStringW MultiByteToWideChar GetStringTypeW RaiseException RtlUnwind FlushFileBuffers WriteConsoleW CreateFileW

user32

CharUpperW

winhttp

WinHttpReadData

Sharing