file[.]exe | Triage™

General

Target
file.exe
Size 308KB
Sample231108-pql2cabb4z
SHA256 4a68fb23b28046804e6f5b5a0959c6f1b1887ae5abe2b2496e47146eaa51eb03
MD5 2e7de78535481637e18324211f96a629
SHA1 797eb8d4a4405d5640606d355303b8cca97032a7
SHA512 66155d5db373cbb705aae6845e74aabf1f9ae582ee44b71ad162ec71c3dd2507a49ea96ea0216861141a5d08e673880ec92f889dd0f0f37d995a42483e2b8ac6
SSDEEP 3072:+G2A1hiEoqXhTwcUY0LIgVejXNB1D/MBrL9x0lIVPgbDh97:ljiEPJwcUYdgV8Hur5uP
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 308KB

file.exe

IMPHASH 42d0102552f70c301978554a13b23c7c
SHA256 4a68fb23b28046804e6f5b5a0959c6f1b1887ae5abe2b2496e47146eaa51eb03
MD5 2e7de78535481637e18324211f96a629
SHA1 797eb8d4a4405d5640606d355303b8cca97032a7
SHA512 66155d5db373cbb705aae6845e74aabf1f9ae582ee44b71ad162ec71c3dd2507a49ea96ea0216861141a5d08e673880ec92f889dd0f0f37d995a42483e2b8ac6
SSDEEP 3072:+G2A1hiEoqXhTwcUY0LIgVejXNB1D/MBrL9x0lIVPgbDh97:ljiEPJwcUYdgV8Hur5uP
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

33068

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindFirstFileW SetLocaleInfoA WriteConsoleInputW lstrlenA GetConsoleAliasExesA GetCPInfo OpenJobObjectA GetEnvironmentStringsW WriteConsoleInputA AddConsoleAliasW MoveFileWithProgressA GetModuleHandleW GetCommConfig GetPrivateProfileStringW ReadConsoleW WaitNamedPipeW GetPrivateProfileIntA LoadLibraryW FatalAppExitW ReadConsoleInputA CopyFileW _hread GetSystemPowerStatus HeapCreate GetConsoleAliasW GetFileAttributesW ReplaceFileW GetCompressedFileSizeA GetTimeZoneInformation CreateActCtxA FindNextVolumeMountPointW GetTempPathW EnumSystemLocalesA GetConsoleOutputCP GetConsoleAliasesW GetStartupInfoA FindFirstFileA GetLastError GetCurrentDirectoryW ReadConsoleOutputCharacterA GetProcAddress RemoveDirectoryA GlobalGetAtomNameA LoadLibraryA LocalAlloc SetConsoleCtrlHandler GetTapeParameters FoldStringA GlobalFindAtomW FindNextFileA GetModuleHandleA CancelIo GetProcessAffinityMask VirtualProtect GetCurrentDirectoryA CompareStringA OpenSemaphoreW GetWindowsDirectoryW FindFirstVolumeW DeleteFileW AddConsoleAliasA GetTempPathA GetProfileSectionW AreFileApisANSI ExpandEnvironmentStringsW CreateFileW CloseHandle WriteConsoleW InterlockedIncrement InterlockedDecrement EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection MoveFileA HeapFree ExitProcess HeapReAlloc GetCommandLineW HeapSetInformation GetStartupInfoW RaiseException RtlUnwind HeapAlloc WideCharToMultiByte LCMapStringW MultiByteToWideChar IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount GetLocaleInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId WriteFile GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapSize GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID GetLocaleInfoA IsValidLocale GetStringTypeW SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers SetStdHandle

user32

CharToOemBuffA CharUpperW

Sharing