file[.]exe | Triage™

General

Target
file.exe
Size 291KB
Sample231204-vlthhsdb71
SHA256 0cdec6aa2a559db4795ff299e8b4b322caf92e6042c9463b828243c97fb7748d
MD5 b01e4b0bcd2380a46e42a927130c752a
SHA1 5fe9bfd36ef7f2d018ae40b02108b6ed58920d16
SHA512 3c904a9ed83c8df4733e4a78100a25b0cbbf610d2485f4bcda023c3413924023fd5b2eadbbd88a3cc7cca4c0d6334af8500db8b6301629d07e049b9159528018
SSDEEP 3072:vIAvOYXd5LrejWGDEHN9GS/0NyN/lPb5UpBwJVZkTkS:QLaLrej4GOpSpBwjiT
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 291KB

file.exe

IMPHASH 01f6fc978b1d93c9a83c4aab7e4e75ac
SHA256 0cdec6aa2a559db4795ff299e8b4b322caf92e6042c9463b828243c97fb7748d
MD5 b01e4b0bcd2380a46e42a927130c752a
SHA1 5fe9bfd36ef7f2d018ae40b02108b6ed58920d16
SHA512 3c904a9ed83c8df4733e4a78100a25b0cbbf610d2485f4bcda023c3413924023fd5b2eadbbd88a3cc7cca4c0d6334af8500db8b6301629d07e049b9159528018
SSDEEP 3072:vIAvOYXd5LrejWGDEHN9GS/0NyN/lPb5UpBwJVZkTkS:QLaLrej4GOpSpBwjiT
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

13530

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

TlsGetValue GlobalAddAtomA GetCurrentProcess CreateJobObjectW SetConsoleScreenBufferSize InterlockedCompareExchange SignalObjectAndWait SetComputerNameW GetModuleHandleW GetTickCount GetDateFormatA EnumTimeFormatsW TzSpecificLocalTimeToSystemTime GetVolumePathNameW GlobalAlloc GlobalFindAtomA LoadLibraryW SizeofResource GetConsoleAliasExesLengthW FormatMessageW GetVersionExW CreateFileW LCMapStringA GetConsoleAliasesW GetLastError SetLastError BackupRead ReadConsoleOutputCharacterA GetNativeSystemInfo VirtualAlloc BeginUpdateResourceW EnumDateFormatsExA HeapUnlock SetComputerNameA OpenMutexA InterlockedExchangeAdd CreateFileMappingA DeleteTimerQueue CreateFileMappingW FindFirstVolumeMountPointW SetThreadIdealProcessor FoldStringW FindFirstVolumeMountPointA FindFirstChangeNotificationA CompareStringA GetCurrentThreadId OpenSemaphoreW SetFileShortNameA EndUpdateResourceA TerminateJobObject GetWindowsDirectoryW lstrcpyA GetFullPathNameA GetComputerNameA GetProcAddress Sleep ExitProcess GetCommandLineA GetStartupInfoA TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement HeapSize WriteFile GetStdHandle GetModuleFileNameA DeleteCriticalSection LeaveCriticalSection EnterCriticalSection TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent LoadLibraryA InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType HeapCreate VirtualFree HeapFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage HeapAlloc HeapReAlloc RtlUnwind GetLocaleInfoA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW

user32

CharUpperW DdeQueryStringW

gdi32

SetDeviceGammaRamp CreateCompatibleBitmap

Sharing