file[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

file.exe
Size

392KB
MD5

3730af498ac2629379bcc119d0ce860d
SHA1

4acab0b02edf90cbdb1306732fa00978a3db3af6
SHA256

afc78f0aee24bf8c3a85f184f7fd3b940d8431ec6d473ecb7a3fd31e2143490c
SHA512

5c018f2f8cc9b505a6f59f326c85ca387bb9a7489aa344e9a3f6747195a947fb22836a659729335b261f174f08cdd9c99156c85c5619d48214a1c490f74fd97b
SSDEEP

6144:ZgXm6qrqRhAyfVG5HfsiBqb71DQiIof7LGTbmNEF3SVdwgLq:Anb8BqFQiIof+TiNEEVqx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

Files

file.exe
.exe windows:4 windows x86

b9d02e5ea5fd765d97dc8fea9c60af25

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TlsFree
GetThreadLocale
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
GetFullPathNameW
lstrlenA
FileTimeToSystemTime
SetErrorMode
FileTimeToLocalFileTime
GetFileTime
HeapFree
HeapAlloc
GetProcessHeap
RtlUnwind
RaiseException
HeapReAlloc
HeapSize
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
SetUnhandledExceptionFilter
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
LocalReAlloc
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
UnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEnvironmentVariableA
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
GlobalFlags
WritePrivateProfileStringW
GetModuleHandleA
FormatMessageW
LocalFree
MulDiv
GlobalFindAtomW
CompareStringW
LoadLibraryA
GetVersionExA
GlobalUnlock
GlobalFree
FreeResource
SetLastError
GlobalAddAtomW
GlobalDeleteAtom
GetCurrentThread
ConvertDefaultLocale
GetVersion
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
CompareStringA
GlobalLock
lstrcmpW
GlobalAlloc
WaitForMultipleObjects
ResetEvent
ResumeThread
GetExitCodeThread
TerminateThread
WaitForSingleObject
CreateThread
CreateMutexW
ExitProcess
GetModuleFileNameW
GetVolumeInformationW
LoadResource
SizeofResource
GetStartupInfoW
GetSystemDirectoryW
TerminateProcess
FindResourceW
LockResource
lstrcmpiW
lstrcpynW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
SetEvent
InterlockedExchangeAdd
CreateEventW
WideCharToMultiByte
GetLocalTime
GetCurrentThreadId
GetCurrentProcessId
GetComputerNameW
lstrcpyW
GetVersionExW
GetModuleHandleW
GetCurrentProcess
MultiByteToWideChar
LoadLibraryW
GetProcAddress
CreateFileW
CloseHandle
MoveFileW
GetLogicalDriveStringsW
GetTickCount
GetDriveTypeW
Sleep
SetFilePointer
ReadFile
WriteFile
FreeLibrary
lstrcatW
FindFirstFileW
FindNextFileW
FindClose
GetLastError
lstrlenW
GetFileAttributesW
DeleteFileW
CreateDirectoryW
InterlockedDecrement
InterlockedIncrement
FreeEnvironmentStringsW
InterlockedExchange

user32

RegisterClipboardFormatW
CharUpperW
GetSysColorBrush
ReleaseCapture
LoadCursorW
SetCapture
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
DestroyMenu
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
GetClassLongW
GetClassNameW
GetPropW
RemovePropW
SetFocus
GetWindowTextW
GetForegroundWindow
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
GetMenu
GetSubMenu
GetMenuItemID
GetMenuItemCount
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetSysColor
AdjustWindowRectEx
EqualRect
CopyRect
PtInRect
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
SetWindowLongW
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
GetWindow
SetWindowContextHelpId
MapDialogRect
SetWindowPos
GetDesktopWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
IsWindow
GetDlgItem
GetNextDlgTabItem
EndDialog
GetWindowThreadProcessId
GetWindowLongW
GetLastActivePopup
UnregisterClassW
MessageBeep
GetNextDlgGroupItem
InvalidateRgn
InvalidateRect
SetRect
IsRectEmpty
CopyAcceleratorTableW
CharNextW
SetPropW
IsWindowEnabled
MessageBoxW
SetCursor
SetWindowsHookExW
CallNextHookEx
GetMessageW
TranslateMessage
DispatchMessageW
GetActiveWindow
IsWindowVisible
GetKeyState
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
GetParent
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
PostMessageW
PostQuitMessage
PostThreadMessageW
GetSystemMetrics
LoadIconW
EnableWindow
GetClientRect
IsIconic
SendMessageW
DrawIcon
PeekMessageW
wsprintfW
UpdateWindow
UnregisterClassA

gdi32

ExtSelectClipRgn
DeleteDC
GetStockObject
PtVisible
GetTextColor
CreateRectRgnIndirect
GetRgnBox
GetMapMode
GetWindowExtEx
GetViewportExtEx
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
TextOutW
GetBkColor
CreateBitmap
DeleteObject
SetMapMode
RestoreDC
SaveDC
ExtTextOutW
GetDeviceCaps
GetObjectW
SetBkColor
SetTextColor
GetClipBox
RectVisible

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

RegSetValueExW
RegCreateKeyExW
RegQueryValueW
RegEnumKeyW
RegDeleteKeyW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyW
RegQueryValueExW
RegCloseKey

shell32

SHFileOperationW
ShellExecuteW

shlwapi

PathFindFileNameW
PathStripToRootW
PathFindExtensionW
PathIsUNCW

oledlg

OleUIBusyW

ole32

OleIsCurrentClipboard
OleFlushClipboard
CLSIDFromProgID
CLSIDFromString
CoTaskMemFree
CoTaskMemAlloc
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
CoRegisterMessageFilter

oleaut32

VariantCopy
SysAllocString
SafeArrayDestroy
SystemTimeToVariantTime
VariantTimeToSystemTime
OleCreateFontIndirect
SysStringLen
VariantInit
VariantChangeType
VariantClear
SysFreeString
SysAllocStringLen

ws2_32

htonl
WSACleanup
WSAStartup
socket
WSAIoctl
ioctlsocket
connect
accept
getsockname
setsockopt
closesocket
gethostbyname
__WSAFDIsSet
WSACreateEvent
send
select
recv
WSASetLastError
WSAGetLastError
ntohs
ntohl
inet_ntoa
htons

netapi32

NetWkstaGetInfo
NetApiBufferFree

Sections

.text
Size: 284KB - Virtual size: 282KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 261KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b9d02e5ea5fd765d97dc8fea9c60af25

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

oledlg

ole32

oleaut32

ws2_32

netapi32

Sections

.text Size: 284KB - Virtual size: 282KB

.rdata Size: 72KB - Virtual size: 69KB

.data Size: 12KB - Virtual size: 261KB

.rsrc Size: 20KB - Virtual size: 19KB

.text
Size: 284KB - Virtual size: 282KB

.rdata
Size: 72KB - Virtual size: 69KB

.data
Size: 12KB - Virtual size: 261KB

.rsrc
Size: 20KB - Virtual size: 19KB