file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 182KB
Sample231031-txhdysda82
SHA256 513c3c2f07c8455f6d465bf22bfd8b11ddfc4c0ba27e231cef4d70a935162ae4
MD5 89e0078eb5a4153ea077497f5a8973e7
SHA1 84934d112255e6f4dcf555c76f922cde6cb23cb2
SHA512 624a3c926c5d4b5fc496f966dfbb51549c402ab8aebed57595e3810fa5a861fe61a200522d648200885e2d0f7dd366ec5b32ff4828e35451bfe4a0668ac9099b
SSDEEP 3072:WUrA616dgjCk9qOGPtS+iOXgXaVBSxJggD8B8M5Akc:HA61kAh9qOGPriOXia20u8T
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 182KB

file.exe

IMPHASH 0c9d3ff66162daea31cb3f02591d560a
SHA256 513c3c2f07c8455f6d465bf22bfd8b11ddfc4c0ba27e231cef4d70a935162ae4
MD5 89e0078eb5a4153ea077497f5a8973e7
SHA1 84934d112255e6f4dcf555c76f922cde6cb23cb2
SHA512 624a3c926c5d4b5fc496f966dfbb51549c402ab8aebed57595e3810fa5a861fe61a200522d648200885e2d0f7dd366ec5b32ff4828e35451bfe4a0668ac9099b
SSDEEP 3072:WUrA616dgjCk9qOGPtS+iOXgXaVBSxJggD8B8M5Akc:HA61kAh9qOGPriOXia20u8T
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13603

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetLocaleInfoA WriteConsoleInputW AllocConsole GlobalCompact WriteConsoleOutputCharacterA ReadConsoleA GetEnvironmentStringsW GetModuleHandleExW GetUserDefaultLCID SetConsoleScreenBufferSize WriteConsoleInputA GetNumaAvailableMemoryNode OpenSemaphoreA SetCommBreak SetTapeParameters GenerateConsoleCtrlEvent FindNextVolumeMountPointA GetWindowsDirectoryA GetCompressedFileSizeW GetConsoleAliasExesW WaitNamedPipeW FindActCtxSectionStringA SetCommState GetDriveTypeA AddRefActCtx GetVolumeInformationA GlobalFindAtomA LoadLibraryW CopyFileW _hread CreateEventA GetConsoleAliasW GetFileAttributesW SetSystemPowerState TerminateProcess ReplaceFileW GetTimeZoneInformation lstrlenW FindNextVolumeMountPointW GetStartupInfoW FindFirstChangeNotificationW GetShortPathNameA GetNamedPipeHandleStateW EnumSystemLocalesA GetConsoleAliasesW FindFirstFileA GetLastError GetCurrentDirectoryW SetLastError CreateConsoleScreenBuffer VerLanguageNameA WriteProfileSectionA CopyFileA EnumSystemCodePagesW SetStdHandle GlobalGetAtomNameA SearchPathA FindClose OpenWaitableTimerA LoadLibraryA LocalAlloc RemoveDirectoryW FindAtomA FoldStringW FindNextFileA GetModuleHandleA FindNextFileW VirtualProtect CompareStringA GetConsoleCursorInfo QueryPerformanceFrequency FatalAppExitA SetProcessShutdownParameters DeleteFileW MoveFileWithProgressW AddConsoleAliasA ResetWriteWatch ReadConsoleOutputCharacterW EnumSystemLocalesW AreFileApisANSI CloseHandle HeapSize RemoveVectoredExceptionHandler GetTempPathW GetVolumeNameForVolumeMountPointA HeapReAlloc GetCommandLineW HeapSetInformation EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer DecodePointer GetCurrentProcess HeapAlloc SetFilePointer HeapFree HeapCreate GetProcAddress GetModuleHandleW ExitProcess WriteFile GetModuleFileNameW FreeEnvironmentStringsW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime Sleep WideCharToMultiByte GetConsoleCP GetConsoleMode RtlUnwind FlushFileBuffers GetCPInfo GetACP GetOEMCP IsValidCodePage WriteConsoleW MultiByteToWideChar IsProcessorFeaturePresent LCMapStringW GetStringTypeW CreateFileW

user32

CharUpperA

gdi32

GetCharWidthFloatW

advapi32

AbortSystemShutdownW

winhttp

WinHttpWriteData