file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 261KB
Sample231122-158dnseh52
SHA256 7ee5c994ac006822269f3fe52d67cee97f5f80850451691a0bb721dc70169bae
MD5 e39c7680cb618b0e9b73de079355a60e
SHA1 a7e610ba6102b77b0ec305919a1a7c98ae551937
SHA512 ccc2f18f900a325e719d194e4ea0db1eebcf8912916884257e8692bf464271c4bc7b4fd516f6ca963db5102dd34f3f241379be8b82142d7be6176813e2f0af09
SSDEEP 3072:deZgkXH6uPzRSvwYcDx8AEKzFf635tqwzDuAep+72:SKuPzRShcKAxU5zDHeMC
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 261KB

file.exe

IMPHASH c368fa427f1f3f59d6f5623ae63cdace
SHA256 7ee5c994ac006822269f3fe52d67cee97f5f80850451691a0bb721dc70169bae
MD5 e39c7680cb618b0e9b73de079355a60e
SHA1 a7e610ba6102b77b0ec305919a1a7c98ae551937
SHA512 ccc2f18f900a325e719d194e4ea0db1eebcf8912916884257e8692bf464271c4bc7b4fd516f6ca963db5102dd34f3f241379be8b82142d7be6176813e2f0af09
SSDEEP 3072:deZgkXH6uPzRSvwYcDx8AEKzFf635tqwzDuAep+72:SKuPzRShcKAxU5zDHeMC
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

24797

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GlobalAddAtomA CreateJobObjectW FreeEnvironmentStringsA GetModuleHandleW CreateNamedPipeW GetWindowsDirectoryA GetGeoInfoW GetVolumePathNameW LoadLibraryW GetSystemWindowsDirectoryA InterlockedPopEntrySList GetNamedPipeInfo GetConsoleAliasW CreateFileW GetConsoleAliasesW GetLastError SetLastError GetProcAddress VirtualAlloc FindResourceW RemoveDirectoryA SearchPathA GetPrivateProfileStringA Process32FirstW OpenWaitableTimerW LocalAlloc CreateFileMappingW GetNumberFormatW SetConsoleWindowInfo GetSystemInfo GlobalFindAtomW FindFirstVolumeMountPointA EndUpdateResourceA ReadConsoleInputW GetCurrentProcessId GetConsoleProcessList GetConsoleAliasExesLengthA TlsGetValue SetLocalTime DebugActiveProcess EnumDateFormatsExA CreateFileA LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCommandLineA GetStartupInfoA RaiseException RtlUnwind Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA TerminateProcess GetCurrentProcess IsDebuggerPresent HeapAlloc HeapFree EnterCriticalSection LeaveCriticalSection SetHandleCount GetFileType DeleteCriticalSection TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement HeapSize CloseHandle GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime LoadLibraryA InitializeCriticalSectionAndSpinCount HeapReAlloc GetModuleHandleA SetFilePointer GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage SetStdHandle FlushFileBuffers GetLocaleInfoA WriteConsoleA GetConsoleOutputCP WriteConsoleW MultiByteToWideChar GetStringTypeA GetStringTypeW LCMapStringA

user32

GetMessageExtraInfo CharToOemBuffA

gdi32

GetCharWidth32A GetCharABCWidthsFloatW

advapi32

LogonUserA ReadEventLogA

shell32

ShellAboutW