file[.]exe | Triage™

General

Target
file.exe
Size 307KB
Sample231201-cgrh9adh2y
SHA256 854454fcf6cdce3223bea2e9cabf030047d7f81537eda0e1ca94baff43cc59e6
MD5 fb6c569fc5072a16c203de7cad9432ea
SHA1 771ed1e38da320f246d4f93af86ca9682d75f255
SHA512 a745a4b25649b01f91b3c6040cd3e0d117a4615b0efa396892658a58ecb98c373955843ca49cf82efa99852c9b0e7ab8db64d98105e7a33a1c1c9ffdc2cbfc67
SSDEEP 3072:cTKdV3O3ijFgJRyiulC629uyN91NM2xLru5tSiMu63jXdo:hLO3wFasiuw6yuyhB+qjX
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 307KB

file.exe

IMPHASH 0bd61e688135eda02fcf13008a67a440
SHA256 854454fcf6cdce3223bea2e9cabf030047d7f81537eda0e1ca94baff43cc59e6
MD5 fb6c569fc5072a16c203de7cad9432ea
SHA1 771ed1e38da320f246d4f93af86ca9682d75f255
SHA512 a745a4b25649b01f91b3c6040cd3e0d117a4615b0efa396892658a58ecb98c373955843ca49cf82efa99852c9b0e7ab8db64d98105e7a33a1c1c9ffdc2cbfc67
SSDEEP 3072:cTKdV3O3ijFgJRyiulC629uyN91NM2xLru5tSiMu63jXdo:hLO3wFasiuw6yuyhB+qjX
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

14084

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadResource GlobalAddAtomA EndUpdateResourceW GetCurrentProcess CreateJobObjectW InterlockedCompareExchange SignalObjectAndWait SetComputerNameW GetComputerNameW GetModuleHandleW GetTickCount GetDateFormatA EnumTimeFormatsW TzSpecificLocalTimeToSystemTime GlobalAlloc SetFileShortNameW GlobalFindAtomA GetConsoleAliasExesLengthW FormatMessageW GetVersionExW SetConsoleCursorPosition CreateFileW GetVolumePathNameA LCMapStringA GetConsoleAliasesW GetLastError SetLastError BackupRead ReadConsoleOutputCharacterA TlsGetValue VirtualAlloc BeginUpdateResourceW EnumDateFormatsExA HeapUnlock SetComputerNameA LoadLibraryA OpenMutexA InterlockedExchangeAdd CreateFileMappingA DeleteTimerQueue CreateFileMappingW FindFirstVolumeMountPointW SetThreadIdealProcessor FoldStringW FindFirstVolumeMountPointA GetModuleHandleA FindFirstChangeNotificationA VirtualProtect CompareStringA GetCurrentThreadId OpenSemaphoreW TerminateJobObject GetWindowsDirectoryW lstrcpyA GetNativeSystemInfo GetProcAddress GetFullPathNameA Sleep ExitProcess GetCommandLineA GetStartupInfoA RaiseException TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement HeapSize WriteFile GetStdHandle GetModuleFileNameA DeleteCriticalSection LeaveCriticalSection EnterCriticalSection TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType HeapCreate VirtualFree HeapFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage HeapAlloc HeapReAlloc RtlUnwind GetLocaleInfoA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW

user32

DdeQueryStringA SetMessageExtraInfo CharUpperW

gdi32

CreateCompatibleBitmap SetDeviceGammaRamp

Sharing