file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 283KB
Sample231128-s77adsbb77
SHA256 9c577a35e83aa1a62ab76f1e1bc7e9b878a54fb1bdeb7df9a93a9aeaa862b5dc
MD5 3bc405996b940a0d75f73cabba76f2ad
SHA1 5c250ac82e2a7f4eb9ad661e14588452742a2515
SHA512 df45fcaaf7b6f302c16e9302de5b623a20735389da81686af50db31e80637a2812adee23d9ff75bc277a3f72f095a82e842c8ce57b594b6080d326c50c11f4b7
SSDEEP 3072:+VhrUI6z9UnyCym01rKQK7bTEamvVVL5e1Qr0xZz:OUI6z9rh1O7bWsbx
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 283KB

file.exe

IMPHASH 8997b51f82bf7e6f2352d47957e9bdb0
SHA256 9c577a35e83aa1a62ab76f1e1bc7e9b878a54fb1bdeb7df9a93a9aeaa862b5dc
MD5 3bc405996b940a0d75f73cabba76f2ad
SHA1 5c250ac82e2a7f4eb9ad661e14588452742a2515
SHA512 df45fcaaf7b6f302c16e9302de5b623a20735389da81686af50db31e80637a2812adee23d9ff75bc277a3f72f095a82e842c8ce57b594b6080d326c50c11f4b7
SSDEEP 3072:+VhrUI6z9UnyCym01rKQK7bTEamvVVL5e1Qr0xZz:OUI6z9rh1O7bWsbx
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13307

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadResource GlobalAddAtomA GetCurrentProcess CreateJobObjectW SignalObjectAndWait SetComputerNameW GetComputerNameW GetModuleHandleW GetTickCount GetWindowsDirectoryA GetDateFormatA TzSpecificLocalTimeToSystemTime GetVolumePathNameW GlobalAlloc GlobalFindAtomA LoadLibraryW SetConsoleCursorPosition CompareStringW LCMapStringA GetConsoleAliasesW OpenMutexW GetLastError SetLastError ReadConsoleOutputCharacterA GetConsoleAliasExesLengthA VirtualAlloc RemoveDirectoryA LoadLibraryA InterlockedExchangeAdd CreateFileMappingW FindFirstVolumeMountPointW SetThreadIdealProcessor FoldStringW FoldStringA EnumDateFormatsA GetModuleHandleA HeapSetInformation VirtualProtect GetCurrentThreadId SetFileShortNameA EndUpdateResourceA TerminateJobObject HeapSize TlsGetValue GetNativeSystemInfo EnumDateFormatsExW GetProcAddress CreateFileA GetLocaleInfoA GetCommandLineA GetStartupInfoA HeapAlloc SetUnhandledExceptionFilter Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement HeapCreate VirtualFree HeapFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter IsDebuggerPresent LeaveCriticalSection EnterCriticalSection HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount RtlUnwind MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW

user32

GetMessageExtraInfo CharUpperW DdeQueryStringA

gdi32

CreateCompatibleBitmap GetDeviceGammaRamp

advapi32

SetKernelObjectSecurity

shell32

ShellAboutW

ole32

StringFromCLSID