file[.]exe | Triage™

General

Target
file.exe
Size 243KB
Sample231201-hmrzvsff46
SHA256 7a5adde924262ecd4fa4d627b02796d7d338104bad89bf2ddc019b678c30d740
MD5 73c9f8e907f5b31e4583d928e833446d
SHA1 3cfb8e1138a759bcd9444acc0c1337afa538058c
SHA512 2c54fc0f6ab619b9dd46eb95f486671c2d9a4dae2ee0f3ca88d108485ce38f96b09dedab2a48da7b7c174062d96e7f9c1f6cad51258bcb2c20af5153897211f5
SSDEEP 6144:uw6fYT2I4wUvNsAc6Lmo1LAxUNBu17r8fck:uwJ4w+NsAcWmo1cObgrt
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 243KB

file.exe

IMPHASH e8e51dea98dc7701b104446165cbe5db
SHA256 7a5adde924262ecd4fa4d627b02796d7d338104bad89bf2ddc019b678c30d740
MD5 73c9f8e907f5b31e4583d928e833446d
SHA1 3cfb8e1138a759bcd9444acc0c1337afa538058c
SHA512 2c54fc0f6ab619b9dd46eb95f486671c2d9a4dae2ee0f3ca88d108485ce38f96b09dedab2a48da7b7c174062d96e7f9c1f6cad51258bcb2c20af5153897211f5
SSDEEP 6144:uw6fYT2I4wUvNsAc6Lmo1LAxUNBu17r8fck:uwJ4w+NsAcWmo1cObgrt
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

35754

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetLocaleInfoA WriteConsoleInputW WritePrivateProfileStructA DeleteVolumeMountPointA VerSetConditionMask ReadConsoleA InterlockedDecrement ZombifyActCtx SetDefaultCommConfigW CreateJobObjectW GetProfileSectionA GetComputerNameW MoveFileWithProgressA FindNextVolumeMountPointA CreateActCtxW GlobalAlloc TerminateThread ReadConsoleInputA SetConsoleCP InterlockedPopEntrySList GlobalFlags WriteConsoleW GetTimeZoneInformation GetNamedPipeHandleStateW GetLargestConsoleWindowSize CreateFileA GetLastError GetProcAddress PeekConsoleInputW VerLanguageNameW SearchPathA GetPrivateProfileStringA SetFileApisToOEM OpenWaitableTimerA LoadLibraryA GetConsoleScreenBufferInfo IsWow64Process BuildCommDCBAndTimeoutsW GetNumberFormatW FoldStringA GlobalFindAtomW GetModuleHandleA GetProcessShutdownParameters OpenFileMappingW GetCPInfoExA LocalSize GetWindowsDirectoryW CloseHandle SetStdHandle FlushFileBuffers FindFirstFileA GetCommandLineW WideCharToMultiByte InterlockedIncrement InterlockedCompareExchange InterlockedExchange MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapFree HeapReAlloc HeapSetInformation GetStartupInfoW GetCPInfo RaiseException RtlUnwind HeapAlloc LCMapStringW IsProcessorFeaturePresent HeapCreate HeapSize GetModuleHandleW ExitProcess SetUnhandledExceptionFilter WriteFile GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime UnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess GetLocaleInfoW GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale LoadLibraryW SetFilePointer GetConsoleCP GetConsoleMode CreateFileW

user32

CharToOemBuffW CharUpperW

advapi32

IsTextUnicode

Sharing