file[.]exe | Triage™

General

Target
file.exe
Size 249KB
Sample231204-aebc5sgc21
SHA256 77fcdc366eed4dc0205f980830716d5a3f97063af4a860023a09787b37e8dc59
MD5 c9625af37f5c06f5558e5bbc7bc8f0d0
SHA1 97ddde94185186a2495edab3b1bd174d9afd8fd4
SHA512 acc6e2fe6b7be9ecb0f4b59c9987f791c0d2b01243d1e4769d915771dd023a25155d4ea5cbc61587bd218580fbfa3915a610959511c96d5bc0ed8cb2a2d1b355
SSDEEP 3072:LxRxKeAo920kivO/qTAbmJ+nQ7W9b0usqTl5CGa2gnY04n46ZBhvTOfDn:VC3oS/yAbmYntgqrCiUH6dvT
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 249KB

file.exe

IMPHASH 5fb506b70643f37b65928468364d30e4
SHA256 77fcdc366eed4dc0205f980830716d5a3f97063af4a860023a09787b37e8dc59
MD5 c9625af37f5c06f5558e5bbc7bc8f0d0
SHA1 97ddde94185186a2495edab3b1bd174d9afd8fd4
SHA512 acc6e2fe6b7be9ecb0f4b59c9987f791c0d2b01243d1e4769d915771dd023a25155d4ea5cbc61587bd218580fbfa3915a610959511c96d5bc0ed8cb2a2d1b355
SSDEEP 3072:LxRxKeAo920kivO/qTAbmJ+nQ7W9b0usqTl5CGa2gnY04n46ZBhvTOfDn:VC3oS/yAbmYntgqrCiUH6dvT
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

42956

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetDefaultCommConfigA FindFirstFileW SetLocaleInfoA WriteConsoleInputW HeapAlloc UpdateResourceA VerSetConditionMask InterlockedDecrement GetNamedPipeHandleStateA GetComputerNameW LocalFlags FindNextVolumeMountPointA GetNumberFormatA ReadConsoleW GetWindowsDirectoryA WriteFile GetCommandLineA GlobalAlloc GetLocaleInfoW ReadConsoleInputA SetConsoleCP GetBinaryTypeA CreateFileW CreateActCtxA GetStartupInfoW CreateJobObjectA GetLastError GetProcAddress HeapSize IsValidCodePage VerLanguageNameW LoadLibraryA WriteConsoleA UnhandledExceptionFilter OpenWaitableTimerW GetConsoleScreenBufferInfo MoveFileA BuildCommDCBAndTimeoutsW GetModuleHandleA GetCPInfoExA SetProcessShutdownParameters LocalSize OpenFileMappingA GetProfileSectionW ExpandEnvironmentStringsW FlushFileBuffers WriteConsoleW SetStdHandle WideCharToMultiByte InterlockedIncrement InterlockedExchange MultiByteToWideChar EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapFree DeleteFileA HeapSetInformation GetCPInfo RaiseException RtlUnwind LCMapStringW IsProcessorFeaturePresent GetACP GetOEMCP TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetLastError GetCurrentThreadId SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess HeapCreate SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType ExitProcess GetModuleFileNameW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale HeapReAlloc SetFilePointer GetConsoleCP GetConsoleMode LoadLibraryW CloseHandle

user32

CharToOemBuffW CharUpperW

Sharing