file[.]exe | Triage™

General

Target
file.exe
Size 267KB
Sample231115-rf4jrabc47
SHA256 588f49a1ba2f244d08911daaf351bc36ac8bffa5802eefe73a0ef1b7c4fc2a7e
MD5 3d7724d6a39457d93e448eaed03664f2
SHA1 d7cf00b272937fb06627ec742fd7e807dc826f71
SHA512 16d37c7e564e25c88d39496f6a706c4ac2228ee2a48a9b50953ec3aab2121f92a0190fcbb7ff57fd29dab06ae0df254c1efde482d136e55d084359a7a63c2a80
SSDEEP 3072:0rTRd31WYPLF8pG1L2ZEQaDDa+/u1TZ0Pb8RuZZ59:e3LF8pGnQqaV1TIb5
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 267KB

file.exe

IMPHASH 840e4842bc97c9779b45301f8bbeab2d
SHA256 588f49a1ba2f244d08911daaf351bc36ac8bffa5802eefe73a0ef1b7c4fc2a7e
MD5 3d7724d6a39457d93e448eaed03664f2
SHA1 d7cf00b272937fb06627ec742fd7e807dc826f71
SHA512 16d37c7e564e25c88d39496f6a706c4ac2228ee2a48a9b50953ec3aab2121f92a0190fcbb7ff57fd29dab06ae0df254c1efde482d136e55d084359a7a63c2a80
SSDEEP 3072:0rTRd31WYPLF8pG1L2ZEQaDDa+/u1TZ0Pb8RuZZ59:e3LF8pGnQqaV1TIb5
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

21028

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetVolumeLabelA CreateFileA SetComputerNameExA GetConsoleAliasExesLengthA FindResourceW GlobalAddAtomA InterlockedIncrement SetConsoleTextAttribute GetConsoleAliasA GetModuleHandleW GetTickCount GetConsoleAliasesA GetWindowsDirectoryA GetPriorityClass GetVolumePathNameW TerminateThread ReadConsoleInputA SizeofResource GetSystemWindowsDirectoryA DeleteVolumeMountPointW EnumSystemCodePagesA IsProcessorFeaturePresent VerifyVersionInfoA lstrcatA GetConsoleAliasesW GetLastError FillConsoleOutputCharacterA SetLastError BackupRead GetProcAddress VirtualAlloc CreateNamedPipeA RemoveDirectoryA CreateMemoryResourceNotification SearchPathA SetFileAttributesA PrepareTape LoadLibraryA OpenWaitableTimerW LocalAlloc GetNumberFormatW FoldStringA GlobalFindAtomW UpdateResourceW FreeEnvironmentStringsW VirtualProtect PeekConsoleInputA GetCurrentProcessId AddConsoleAliasA InterlockedFlushSList LCMapStringW LCMapStringA Sleep ExitProcess GetStartupInfoW RaiseException RtlUnwind TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc HeapFree TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId InterlockedDecrement HeapSize WriteFile GetStdHandle GetModuleFileNameA DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionAndSpinCount GetModuleFileNameW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetSystemTimeAsFileTime HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage GetLocaleInfoA WideCharToMultiByte GetStringTypeA MultiByteToWideChar GetStringTypeW

user32

CharToOemBuffA GetMessageExtraInfo

gdi32

GetCharABCWidthsFloatW

winhttp

WinHttpWriteData

Sharing