file[.]exe | Triage™

General

Target
file.exe
Size 281KB
Sample231121-pygrlaee28
SHA256 04ee31ace9e5b55806f4cb1e83cc10ea5387bb637e95e6931edde9fa2a1de97c
MD5 f1372e38be895c6fcef41615d31dc929
SHA1 b981cd9208bcd402f673c08ca02a9ecc457db739
SHA512 68121a43b4bda849c54661590665deab39728507a9244fe17f190d7afb92e034c11fb570da3ec0dc8ce972bd389bb8f1b7397ecb5d62732fc6433e2ddf318f49
SSDEEP 3072:SxDmuK9281B52x0+OA5dojhWcvYSoslmmIHLk5LPYt+zD:SYlB0xROAwjhWMPF6LCPYtw
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 281KB

file.exe

IMPHASH 923cbd0d1f3cf613e02a29f506228f6f
SHA256 04ee31ace9e5b55806f4cb1e83cc10ea5387bb637e95e6931edde9fa2a1de97c
MD5 f1372e38be895c6fcef41615d31dc929
SHA1 b981cd9208bcd402f673c08ca02a9ecc457db739
SHA512 68121a43b4bda849c54661590665deab39728507a9244fe17f190d7afb92e034c11fb570da3ec0dc8ce972bd389bb8f1b7397ecb5d62732fc6433e2ddf318f49
SSDEEP 3072:SxDmuK9281B52x0+OA5dojhWcvYSoslmmIHLk5LPYt+zD:SYlB0xROAwjhWMPF6LCPYtw
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

33911

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GlobalFix SetProcessAffinityMask CreateFileA GetFileSize FindFirstFileW WriteConsoleInputW WriteConsoleOutputCharacterW BuildCommDCBAndTimeoutsA DeleteVolumeMountPointA InterlockedIncrement GetCommState InterlockedDecrement GetNamedPipeHandleStateA MoveFileWithProgressA GetModuleHandleW LocalFlags ReadConsoleW GetWindowsDirectoryA GetCommandLineA CreateActCtxW GlobalAlloc LoadLibraryW TerminateThread ReadConsoleInputA GlobalFlags GetConsoleAliasW SetSystemPowerState ReplaceFileW GetTimeZoneInformation GetTempPathW DeactivateActCtx GetLargestConsoleWindowSize GetConsoleOutputCP GetLastError SetLastError GetProcAddress VerLanguageNameW GetPrivateProfileStringA GetProcessId OpenWaitableTimerW GetConsoleScreenBufferInfo AddAtomW GlobalGetAtomNameW FoldStringW GlobalFindAtomW GetModuleHandleA GetProcessShutdownParameters WriteProfileStringW GetWindowsDirectoryW GetVolumeNameForVolumeMountPointW AddConsoleAliasA GetVolumeInformationW SetStdHandle WriteConsoleW CloseHandle EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapFree HeapAlloc ExitProcess GetCommandLineW HeapSetInformation GetStartupInfoW RaiseException RtlUnwind WideCharToMultiByte LCMapStringW MultiByteToWideChar GetCPInfo IsProcessorFeaturePresent HeapCreate WriteFile GetStdHandle GetModuleFileNameW HeapSize UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess InitializeCriticalSectionAndSpinCount GetLocaleInfoW TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeW HeapReAlloc GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer CreateFileW

user32

CharToOemBuffW CharUpperW

Sharing