file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 291KB
Sample231130-l5mpmsae25
SHA256 834b73d2202e64d5ad7aca2f5763c5fa77683e7144ba53eb385a381cd99fc4ae
MD5 51e50dfbf67940c827d069d692e6c587
SHA1 7d726544446574ff471476ff511f1fbb58cc318c
SHA512 c01adfd4492dacfaf4619c423c41aad89a80104935a30853789061c08d021c39b64651bf980d8f58f3ae9e8e199108992c4dde6b7ac0df4b275f06a6981bb533
SSDEEP 3072:/dvxRGMCTxeESrsqwjopRiX1uFPvNotrNtrs6s50RThUXgUM:HRGdTxeEwYAO4ZvNohNzpR64
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 291KB

file.exe

IMPHASH 52c989b623059b029b98f089e46c54ff
SHA256 834b73d2202e64d5ad7aca2f5763c5fa77683e7144ba53eb385a381cd99fc4ae
MD5 51e50dfbf67940c827d069d692e6c587
SHA1 7d726544446574ff471476ff511f1fbb58cc318c
SHA512 c01adfd4492dacfaf4619c423c41aad89a80104935a30853789061c08d021c39b64651bf980d8f58f3ae9e8e199108992c4dde6b7ac0df4b275f06a6981bb533
SSDEEP 3072:/dvxRGMCTxeESrsqwjopRiX1uFPvNotrNtrs6s50RThUXgUM:HRGdTxeEwYAO4ZvNohNzpR64
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14146

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadResource GetCurrentProcess CreateJobObjectW InterlockedCompareExchange SignalObjectAndWait GetComputerNameW GetModuleHandleW GetTickCount FormatMessageA GetWindowsDirectoryA EnumTimeFormatsA GetDateFormatA TzSpecificLocalTimeToSystemTime GetVolumePathNameW GlobalAlloc SetFileShortNameW GlobalFindAtomA GetConsoleAliasExesLengthW SetConsoleCursorPosition CreateFileW LCMapStringA GetConsoleAliasesW OpenMutexW GetLastError SetLastError GetProcAddress BackupWrite HeapUnlock RemoveDirectoryA SetComputerNameA LoadLibraryA InterlockedExchangeAdd CreateFileMappingA CreateFileMappingW FindFirstVolumeMountPointW SetThreadIdealProcessor FoldStringA VirtualProtect CompareStringA GetCurrentThreadId OpenSemaphoreW EndUpdateResourceA TerminateJobObject GlobalAddAtomW ReadConsoleOutputCharacterW TlsGetValue FindVolumeClose EnumDateFormatsExW VirtualAlloc GetNativeSystemInfo UnhandledExceptionFilter SetUnhandledExceptionFilter Sleep ExitProcess GetCommandLineA GetStartupInfoA WriteFile GetStdHandle GetModuleFileNameA RaiseException TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement DeleteCriticalSection LeaveCriticalSection EnterCriticalSection TerminateProcess IsDebuggerPresent InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType HeapCreate VirtualFree HeapFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetModuleHandleA GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind HeapSize GetLocaleInfoA HeapAlloc HeapReAlloc MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW

user32

GetMessageExtraInfo CharUpperW DdeQueryStringA

gdi32

CreateCompatibleBitmap GetDeviceGammaRamp

advapi32

SetKernelObjectSecurity

ole32

StringFromCLSID