file[.]exe | Triage™

General

Target
file.exe
Size 220KB
Sample231203-bct8xagg5x
SHA256 55b59e8d99c3df97556a24b0253f5eff7ac9d95445e98f355383fea6ac8b9bb0
MD5 539a20213504d4b0c665549576bd2d0d
SHA1 4ebdeae60339725d173df7268d4faaa92ebd591f
SHA512 774b1c086d131cc4522fc370cc7146e09498ea216954c9ddd50f26061b74b1bab24be9b91cf075eb4fdb3807e1b68fea48887972b9a6dfc8d9758189525bb684
SSDEEP 3072:P5ESpOvHdgPwuQ08VTbBD1iP5y3yJtS2oxUiu8IDuXo7PESp9:+/Hdes08VTbBYBy34v8IDuXo7ESP
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 220KB

file.exe

IMPHASH 8c5db66a31be73b4cefcbea78208a6f8
SHA256 55b59e8d99c3df97556a24b0253f5eff7ac9d95445e98f355383fea6ac8b9bb0
MD5 539a20213504d4b0c665549576bd2d0d
SHA1 4ebdeae60339725d173df7268d4faaa92ebd591f
SHA512 774b1c086d131cc4522fc370cc7146e09498ea216954c9ddd50f26061b74b1bab24be9b91cf075eb4fdb3807e1b68fea48887972b9a6dfc8d9758189525bb684
SSDEEP 3072:P5ESpOvHdgPwuQ08VTbBD1iP5y3yJtS2oxUiu8IDuXo7PESp9:+/Hdes08VTbBYBy34v8IDuXo7ESP
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

35134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetComputerNameA CreateFileA SetDefaultCommConfigA FindFirstFileW SetLocaleInfoA WriteConsoleInputW HeapAlloc UpdateResourceA VerSetConditionMask InterlockedDecrement GetNamedPipeHandleStateA OutputDebugStringW GetNumberFormatA ReadConsoleW WriteFile GetCommandLineA GlobalAlloc TerminateThread GetLocaleInfoW ReadConsoleInputA SetConsoleCP GlobalFlags CreateActCtxA FindNextVolumeMountPointW GetStartupInfoW CreateJobObjectA GetCPInfoExW GetLastError GetProcAddress HeapSize IsValidCodePage VerLanguageNameW LoadLibraryA WriteConsoleA UnhandledExceptionFilter OpenWaitableTimerW GetConsoleScreenBufferInfo IsWow64Process BuildCommDCBAndTimeoutsW GetModuleHandleA OpenFileMappingW SetProcessShutdownParameters LocalSize GetWindowsDirectoryW GetProfileSectionW ExpandEnvironmentStringsW CloseHandle WriteConsoleW SetStdHandle WideCharToMultiByte InterlockedIncrement InterlockedCompareExchange InterlockedExchange MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapFree HeapReAlloc GetCommandLineW HeapSetInformation GetCPInfo RaiseException RtlUnwind LCMapStringW IsProcessorFeaturePresent GetModuleHandleW ExitProcess SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess GetACP GetOEMCP TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId HeapCreate GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale LoadLibraryW SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers CreateFileW

user32

CharToOemBuffW CharUpperW

Sharing