file[.]exe | Triage™

General

Target
file.exe
Size 168KB
Sample231029-grfa7aeg7v
SHA256 e1a44604533a1b1d897da2c3263b0252043a9a5e8acc2c6d20a46e59f84e4a52
MD5 490d98aed63320ffb22f17b08ce0f443
SHA1 131265a5c3ef11e0f1937c915db897326e79726e
SHA512 a02dc7a18dd41e4446eb4f3d96e9f53449e8b0f67f715457ae2a23a9155d89eea5b261ed86c9fb62186bba3c058429bc70a33aabf68786cc4efaa989c2615efd
SSDEEP 3072:dpXIQI94kYIU2doIX6rWzoDdNJfcZ3DpCqrqIRw:zIp4kVJdozJBcZ3Dp9
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 168KB

file.exe

IMPHASH a75c932ec0688c10f7354ecf57fbb5b0
SHA256 e1a44604533a1b1d897da2c3263b0252043a9a5e8acc2c6d20a46e59f84e4a52
MD5 490d98aed63320ffb22f17b08ce0f443
SHA1 131265a5c3ef11e0f1937c915db897326e79726e
SHA512 a02dc7a18dd41e4446eb4f3d96e9f53449e8b0f67f715457ae2a23a9155d89eea5b261ed86c9fb62186bba3c058429bc70a33aabf68786cc4efaa989c2615efd
SSDEEP 3072:dpXIQI94kYIU2doIX6rWzoDdNJfcZ3DpCqrqIRw:zIp4kVJdozJBcZ3Dp9
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

21429

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetDefaultCommConfigA RemoveVectoredExceptionHandler FindFirstFileW FindFirstChangeNotificationW WriteConsoleInputW WriteConsoleOutputCharacterW lstrlenA GetModuleHandleExA GetConsoleAliasExesA AllocConsole IsBadHugeReadPtr GetProcessIoCounters MapUserPhysicalPages GetConsoleAliasA ZombifyActCtx SetConsoleScreenBufferSize WriteConsoleInputA AddConsoleAliasW GetNumaAvailableMemoryNode OpenSemaphoreA GetSystemDefaultLCID MoveFileWithProgressA GenerateConsoleCtrlEvent FindNextVolumeMountPointA GetConsoleAliasesA ReadConsoleW GetWindowsDirectoryA WaitNamedPipeW SetCommState GetDriveTypeA GetEnvironmentStrings GlobalAlloc AddRefActCtx GetVolumeInformationA LoadLibraryW CopyFileW _hread CreateEventA GetExitCodeProcess TransactNamedPipe GetFileAttributesW GlobalFix GetCompressedFileSizeA lstrcatA lstrlenW FindNextVolumeMountPointW GetStartupInfoW ReplaceFileA GetTempPathW GetShortPathNameA GetNamedPipeHandleStateW GetStartupInfoA GetLastError SetLastError ReadConsoleOutputCharacterA CreateConsoleScreenBuffer CreateNamedPipeA EnumSystemCodePagesW SetStdHandle VerLanguageNameW OpenWaitableTimerA UnhandledExceptionFilter AddAtomW RemoveDirectoryW FoldStringW GetModuleHandleA FatalExit FindNextFileW VirtualProtect GetCurrentDirectoryA CompareStringA GetFileTime QueryPerformanceFrequency GetShortPathNameW SetProcessShutdownParameters FindAtomW GetVolumeNameForVolumeMountPointW DeleteFileW ResetWriteWatch GetSystemTime EnumSystemLocalesW lstrcpyW AreFileApisANSI WriteConsoleW CloseHandle SetTimeZoneInformation DebugActiveProcess SetFilePointer FlushFileBuffers MoveFileA HeapAlloc HeapReAlloc GetCommandLineW HeapSetInformation EncodePointer DecodePointer IsProcessorFeaturePresent GetProcAddress GetModuleHandleW ExitProcess WriteFile GetStdHandle GetModuleFileNameW HeapCreate EnterCriticalSection LeaveCriticalSection SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess HeapFree FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RaiseException GetCPInfo GetACP GetOEMCP IsValidCodePage Sleep WideCharToMultiByte RtlUnwind HeapSize LCMapStringW MultiByteToWideChar GetStringTypeW GetConsoleCP GetConsoleMode CreateFileW

user32

CharUpperW

advapi32

AbortSystemShutdownA

winhttp

WinHttpReadData

Sharing