file[.]exe | Triage™

General

Target
file.exe
Size 290KB
Sample231204-yd2qpsfb28
SHA256 fe51a9deb7a5465e8bfd3aaa8352e036613f1c9f257c2dce810b5e01bab5bace
MD5 f57035d13d2cc9777b2c8df6e2470fa2
SHA1 4e563e4957bfb8d1f2f504a640e14ed230463a78
SHA512 699178f8f2ab0494eddf35770bbea1797ddd75afa78dc701f672583325809a7e2dea4e6aba40031546dfae480a0ff3e80ec99f4c318c7903c6fd276ad1efa872
SSDEEP 3072:M/tOuYXdXa+844dvwNwvxk9ThdGYCMd60iAJt17K+5Up0cVZkTkS:gHB4kvwavxATh0YCjc7Qp06iT
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 290KB

file.exe

IMPHASH 01f6fc978b1d93c9a83c4aab7e4e75ac
SHA256 fe51a9deb7a5465e8bfd3aaa8352e036613f1c9f257c2dce810b5e01bab5bace
MD5 f57035d13d2cc9777b2c8df6e2470fa2
SHA1 4e563e4957bfb8d1f2f504a640e14ed230463a78
SHA512 699178f8f2ab0494eddf35770bbea1797ddd75afa78dc701f672583325809a7e2dea4e6aba40031546dfae480a0ff3e80ec99f4c318c7903c6fd276ad1efa872
SSDEEP 3072:M/tOuYXdXa+844dvwNwvxk9ThdGYCMd60iAJt17K+5Up0cVZkTkS:gHB4kvwavxATh0YCjc7Qp06iT
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

13530

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

TlsGetValue GlobalAddAtomA GetCurrentProcess CreateJobObjectW SetConsoleScreenBufferSize InterlockedCompareExchange SignalObjectAndWait SetComputerNameW GetModuleHandleW GetTickCount GetDateFormatA EnumTimeFormatsW TzSpecificLocalTimeToSystemTime GetVolumePathNameW GlobalAlloc GlobalFindAtomA LoadLibraryW SizeofResource GetConsoleAliasExesLengthW FormatMessageW GetVersionExW CreateFileW LCMapStringA GetConsoleAliasesW GetLastError SetLastError BackupRead ReadConsoleOutputCharacterA GetNativeSystemInfo VirtualAlloc BeginUpdateResourceW EnumDateFormatsExA HeapUnlock SetComputerNameA OpenMutexA InterlockedExchangeAdd CreateFileMappingA DeleteTimerQueue CreateFileMappingW FindFirstVolumeMountPointW SetThreadIdealProcessor FoldStringW FindFirstVolumeMountPointA FindFirstChangeNotificationA CompareStringA GetCurrentThreadId OpenSemaphoreW SetFileShortNameA EndUpdateResourceA TerminateJobObject GetWindowsDirectoryW lstrcpyA GetFullPathNameA GetComputerNameA GetProcAddress Sleep ExitProcess GetCommandLineA GetStartupInfoA TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement HeapSize WriteFile GetStdHandle GetModuleFileNameA DeleteCriticalSection LeaveCriticalSection EnterCriticalSection TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent LoadLibraryA InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType HeapCreate VirtualFree HeapFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage HeapAlloc HeapReAlloc RtlUnwind GetLocaleInfoA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW

user32

CharUpperW DdeQueryStringW

gdi32

SetDeviceGammaRamp CreateCompatibleBitmap

Sharing