file[.]exe | Triage™

General

Target
file.exe
Size 250KB
Sample231115-tmx2nade2y
SHA256 03c4bbba0969018b4e4e048b8f3c52ce0d99a3e37da9ed11a18997e8a836f28f
MD5 ff28a5db6dd5a5a41fb628f1e64c6cd2
SHA1 108f237faea0728bc97174ddff475dfe789ee88d
SHA512 134d27d3e1ec194d7ae5397a7a52dde99bceb7ee3c089cbb7acb308d7e3f2ca5befc59d71b3c719d7d65883b1c3bbec36e697cadf8c5904a53bf292a7cd6f602
SSDEEP 3072:lN6RLi2HD+n0KYpiFu3Sek8EkhuLR2sVFCco9CR:HgLi2Hs0JpQns9EC
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 250KB

file.exe

IMPHASH fb752e503b6d05b37aeae46cd3910859
SHA256 03c4bbba0969018b4e4e048b8f3c52ce0d99a3e37da9ed11a18997e8a836f28f
MD5 ff28a5db6dd5a5a41fb628f1e64c6cd2
SHA1 108f237faea0728bc97174ddff475dfe789ee88d
SHA512 134d27d3e1ec194d7ae5397a7a52dde99bceb7ee3c089cbb7acb308d7e3f2ca5befc59d71b3c719d7d65883b1c3bbec36e697cadf8c5904a53bf292a7cd6f602
SSDEEP 3072:lN6RLi2HD+n0KYpiFu3Sek8EkhuLR2sVFCco9CR:HgLi2Hs0JpQns9EC
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

20629

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetVolumeLabelA CreateFileA FindResourceA GetNativeSystemInfo SetComputerNameExA GetConsoleAliasExesLengthA GlobalAddAtomA InterlockedIncrement SetConsoleTextAttribute GetConsoleAliasA GetModuleHandleW GetTickCount GetConsoleAliasesA GetWindowsDirectoryA GetPriorityClass GetVolumePathNameW TerminateThread SizeofResource GetSystemWindowsDirectoryA DeleteVolumeMountPointW EnumSystemCodePagesA VerifyVersionInfoA lstrcatA GetConsoleAliasesW GetLastError InterlockedFlushSList FillConsoleOutputCharacterA BackupRead GetProcAddress VirtualAlloc CreateNamedPipeA RemoveDirectoryA CreateMemoryResourceNotification SearchPathA SetFileAttributesA PrepareTape LoadLibraryA OpenWaitableTimerW LocalAlloc GetNumberFormatW FoldStringA GlobalFindAtomW UpdateResourceW FreeEnvironmentStringsW VirtualProtect PeekConsoleInputA ReadConsoleInputW GetCurrentProcessId AddConsoleAliasA SetLastError LCMapStringW LCMapStringA Sleep ExitProcess GetStartupInfoW RaiseException RtlUnwind TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc HeapFree TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId InterlockedDecrement HeapSize WriteFile GetStdHandle GetModuleFileNameA DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionAndSpinCount GetModuleFileNameW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetSystemTimeAsFileTime HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage GetLocaleInfoA WideCharToMultiByte GetStringTypeA MultiByteToWideChar GetStringTypeW

user32

CharToOemBuffA GetMessageExtraInfo

gdi32

GetCharABCWidthsFloatW

winhttp

WinHttpWriteData

Sharing