file[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

file.exe
Size

231KB
MD5

1c32647a706fbef6faeac45a75201489
SHA1

9055c809cc813d8358bc465603165be70f9216b7
SHA256

f60e23e0d5cbd44794977c641d07228f8c7a9255f469a1fe9b2ae4c4cc009edc
SHA512

c8acb58b5686b5daf16de893a9a09c61429892b61195442c456982b14be16baef714b4cf1ad61705480afb880c48d82ace5f65a055ad3bad204a8e776971a3d0
SSDEEP

3072:lvkpbAuLG+BPk/AAKozNEGwRhZ7JLgf7nDVF6PUp1Yo3ICghM:F6n6aAzNEGwRn75gfzDVlVXg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

Files

file.exe
.exe windows:10 windows x86

e48add634ee19ef51fd7cf0c4997bc64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

OpenProcessToken
GetTokenInformation
DuplicateEncryptionInfoFile
RegSetValueExW
RegQueryValueExW
RegCreateKeyW
RegCloseKey
RegOpenKeyExW
EventSetInformation
EventRegister
EventUnregister
EventWriteTransfer
IsTextUnicode
DecryptFileW

kernel32

CreateFileMappingW
MapViewOfFile
MultiByteToWideChar
LocalReAlloc
UnmapViewOfFile
LocalSize
GetStartupInfoW
FindNLSString
GlobalLock
GlobalUnlock
GlobalAlloc
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
GetFileInformationByHandle
GetCurrentProcessId
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
HeapAlloc
GetProcAddress
CreateMutexExW
GetProcessHeap
GetModuleHandleW
DebugBreak
IsDebuggerPresent
GetFileAttributesExW
GetFullPathNameW
SetEndOfFile
DeleteFileW
LocalUnlock
GetACP
LocalLock
GetLastError
GetFileAttributesW
WriteFile
SetLastError
WideCharToMultiByte
GetTimeFormatW
GetDateFormatW
GetLocalTime
GetUserDefaultUILanguage
FoldStringW
FormatMessageW
FindClose
FindFirstFileW
lstrcmpW
ReleaseSemaphore
FreeLibrary
LocalFree
HeapSetInformation
GetCommandLineW
GetCurrentProcess
MulDiv
GetLocaleInfoW
GlobalFree
lstrcmpiW
LocalAlloc
CloseHandle
ReadFile
CreateFileW
SetErrorMode
GetModuleHandleExW

gdi32

StartPage
StartDocW
SetAbortProc
DeleteDC
EndDoc
AbortDoc
EndPage
GetTextMetricsW
SetBkMode
LPtoDP
SetWindowExtEx
SetViewportExtEx
SetMapMode
GetTextExtentPoint32W
TextOutW
EnumFontsW
GetTextFaceW
SelectObject
DeleteObject
CreateFontIndirectW
GetDeviceCaps
CreateDCW

user32

SetWinEventHook
GetMessageW
IsDialogMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
UnhookWinEvent
SetWindowTextW
GetMenuState
OpenClipboard
IsClipboardFormatAvailable
CloseClipboard
SetDlgItemTextW
GetDlgItemTextW
EndDialog
SendDlgItemMessageW
WinHelpW
GetCursorPos
ScreenToClient
ChildWindowFromPoint
CharNextW
SetScrollPos
InvalidateRect
UpdateWindow
GetWindowPlacement
SetWindowPlacement
CharUpperW
GetSystemMenu
LoadAcceleratorsW
SetWindowLongW
CreateWindowExW
RegisterWindowMessageW
LoadCursorW
RegisterClassExW
GetWindowTextLengthW
GetWindowLongW
PeekMessageW
GetWindowTextW
EnableWindow
CreateDialogParamW
DrawTextExW
GetKeyboardLayout
RedrawWindow
SetWindowPos
GetDlgCtrlID
MessageBeep
GetForegroundWindow
DestroyWindow
PostQuitMessage
IsIconic
DefWindowProcW
LoadStringW
SetActiveWindow
SetCursor
GetDpiForWindow
ReleaseDC
GetParent
GetDC
ShowWindow
CheckMenuItem
MessageBoxW
GetFocus
DialogBoxParamW
SetFocus
EnableMenuItem
GetMenu
PostMessageW
SetThreadDpiAwarenessContext
MoveWindow
GetClientRect
GetSubMenu
SendMessageW
LoadIconW
LoadImageW

msvcrt

__dllonexit
_unlock
_lock
_except_handler4_common
_acmdln
_initterm
__setusermatherr
_onexit
_callnewh
_ismbblead
__p__fmode
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
__p__commode
_XcptFilter
free
memcpy_s
iswctype
wcsnlen
_wcsicmp
_wtol
_vsnwprintf
?terminate@@YAXXZ
_controlfp
memcpy
malloc
__CxxFrameHandler3
strchr
_purecall
memset

api-ms-win-core-com-l1-1-0

CoInitializeEx
CoCreateGuid
CoTaskMemAlloc
CoTaskMemFree
CoCreateFreeThreadedMarshaler
PropVariantClear
CoUninitialize
CoCreateInstance
CoWaitForMultipleHandles

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException

api-ms-win-core-processthreads-l1-1-0

TerminateProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW
LoadLibraryExW

api-ms-win-core-processthreads-l1-1-1

GetProcessMitigationPolicy

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsCreateString
WindowsGetStringRawBuffer
WindowsCreateStringReference

api-ms-win-core-synch-l1-1-0

SetEvent
CreateEventExW

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-winrt-l1-1-0

RoUninitialize
RoInitialize
RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo

comctl32

ord345
CreateStatusWindowW

comdlg32

ChooseFontW
GetFileTitleW
FindTextW
PageSetupDlgW
GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError
PrintDlgExW
ReplaceTextW

ntdll

WinSqmAddToStream

propsys

PSGetPropertyDescriptionListFromString
PropVariantToStringVectorAlloc

shell32

SHCreateItemFromParsingName
DragQueryFileW
SHAddToRecentDocs
DragFinish
DragAcceptFiles
ShellExecuteW
ShellAboutW

shlwapi

PathIsFileSpecW
PathFileExistsW
PathIsNetworkPathW
PathFindExtensionW
SHStrDupW

winspool.drv

OpenPrinterW
ClosePrinter
GetPrinterDriverW

urlmon

FindMimeFromData

Sections

.text
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e48add634ee19ef51fd7cf0c4997bc64

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

comctl32

comdlg32

ntdll

propsys

shell32

shlwapi

winspool.drv

urlmon

Sections

.text Size: 108KB - Virtual size: 108KB

.data Size: 2KB - Virtual size: 9KB

.idata Size: 8KB - Virtual size: 8KB

.rsrc Size: 103KB - Virtual size: 103KB

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 108KB - Virtual size: 108KB

.data
Size: 2KB - Virtual size: 9KB

.idata
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 103KB - Virtual size: 103KB

.reloc
Size: 7KB - Virtual size: 7KB