file[.]exe | Triage™

General

Target
file.exe
Size 166KB
Sample231028-hhgnbsfa3z
SHA256 60c362f073df8d07e13eb47a3cffaf20f89caaf3a5617279deb5b14221652152
MD5 834969da5b9b2794bbd49bcf17de7f13
SHA1 a646a01a0895c01dc4a38a28f443702071530e2b
SHA512 9915e3078abaae88a7cc09cb4b9de7150c7d2d42d833f3792e43df0fcc390e84047890022759b9778749bb3f45a242a25579585ea93fb02f36cbbbb3531fa2b9
SSDEEP 3072:96QXQboHpD3D8oW9EFkd+JkIEYNcrQknTdhvj60kjvW7gb7c:JecpD3D89i6aEYWrjn2vW7
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 166KB

file.exe

IMPHASH 3bac95f73a8806a7ed6e32cd0b1a0809
SHA256 60c362f073df8d07e13eb47a3cffaf20f89caaf3a5617279deb5b14221652152
MD5 834969da5b9b2794bbd49bcf17de7f13
SHA1 a646a01a0895c01dc4a38a28f443702071530e2b
SHA512 9915e3078abaae88a7cc09cb4b9de7150c7d2d42d833f3792e43df0fcc390e84047890022759b9778749bb3f45a242a25579585ea93fb02f36cbbbb3531fa2b9
SSDEEP 3072:96QXQboHpD3D8oW9EFkd+JkIEYNcrQknTdhvj60kjvW7gb7c:JecpD3D89i6aEYWrjn2vW7
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

22038

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetVolumeNameForVolumeMountPointA DebugActiveProcess SetDefaultCommConfigA RemoveVectoredExceptionHandler FindFirstFileW WriteConsoleInputW WriteConsoleOutputCharacterW lstrlenA GetModuleHandleExA GetLocaleInfoA AllocConsole GetProcessIoCounters MapUserPhysicalPages GetCommState WaitNamedPipeA ZombifyActCtx SetHandleInformation SetConsoleScreenBufferSize WriteConsoleInputA AddConsoleAliasW OpenSemaphoreA GetSystemDefaultLCID _lclose MoveFileWithProgressA GetModuleHandleW GenerateConsoleCtrlEvent FindNextVolumeMountPointA ReadConsoleW GetWindowsDirectoryA GetConsoleAliasExesW SetCommState GetCommandLineA GetDriveTypeA GetEnvironmentStrings GlobalAlloc AddRefActCtx LoadLibraryW ReadConsoleInputA CopyFileW _hread CreateEventA GetExitCodeProcess GetConsoleAliasW GetFileAttributesW GetCompressedFileSizeA lstrlenW GetStartupInfoW ReplaceFileA GetShortPathNameA GetConsoleAliasesW GetStartupInfoA SetThreadLocale GetLastError SetLastError ReadConsoleOutputCharacterA VerLanguageNameA CreateNamedPipeA CopyFileA EnumSystemCodePagesW SetStdHandle GetTempFileNameA OpenWaitableTimerA UnhandledExceptionFilter AddAtomW SetCurrentDirectoryW RemoveDirectoryW FoldStringW FindNextFileA GetModuleHandleA lstrcatW FatalExit FindNextFileW VirtualProtect GetCurrentDirectoryA CompareStringA GetFileTime GetConsoleCursorInfo QueryPerformanceFrequency SetProcessShutdownParameters Module32NextW FindAtomW GetTempPathA ResetWriteWatch GetSystemTime EnumSystemLocalesW DeleteFileA lstrcpyA HeapSize WideCharToMultiByte HeapAlloc HeapReAlloc GetCommandLineW HeapSetInformation DecodePointer SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess GetCurrentProcess GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId GetProcAddress IsProcessorFeaturePresent ExitProcess WriteFile GetStdHandle GetModuleFileNameW HeapCreate EnterCriticalSection LeaveCriticalSection HeapFree CloseHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer GetConsoleCP GetConsoleMode Sleep LCMapStringW MultiByteToWideChar GetStringTypeW RaiseException RtlUnwind FlushFileBuffers WriteConsoleW CreateFileW

user32

CharUpperW

winhttp

WinHttpReadData

Sharing