file[.]exe | Triage™

General

Target
file.exe
Size 365KB
Sample231206-2q313sgafp
SHA256 4b37fefe23ca01589124d88bb22b599b9237bb90776a59a992e0ffc25af5bf87
MD5 610f1e27d5e8b64164b88540eceb1214
SHA1 7502ce2f0260514efa45d487e2d6875c12eea70f
SHA512 70b3e62a3d6b5f66c606138c97bc21ea97a4d763e2ec52448114fc605be8e0ca7385d35a85edd181b4e4ed64c0e446d6696f305f0c891930fbcf9999ca09c931
SSDEEP 3072:sRimVRiAZ5nEzHtjs/0qOKuu0SMWbr+X045jd7Vdb9r6+:/+kAZpEzNs/V3+EUDh
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 365KB

file.exe

IMPHASH b1748a5ec295eb41ddbfc92f1911a309
SHA256 4b37fefe23ca01589124d88bb22b599b9237bb90776a59a992e0ffc25af5bf87
MD5 610f1e27d5e8b64164b88540eceb1214
SHA1 7502ce2f0260514efa45d487e2d6875c12eea70f
SHA512 70b3e62a3d6b5f66c606138c97bc21ea97a4d763e2ec52448114fc605be8e0ca7385d35a85edd181b4e4ed64c0e446d6696f305f0c891930fbcf9999ca09c931
SSDEEP 3072:sRimVRiAZ5nEzHtjs/0qOKuu0SMWbr+X045jd7Vdb9r6+:/+kAZpEzNs/V3+EUDh
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

11847

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateFileA GetNativeSystemInfo TlsGetValue GetConsoleAliasExesLengthA SystemTimeToTzSpecificLocalTime GlobalAddAtomA GetCurrentProcess CreateJobObjectW SetConsoleScreenBufferSize InterlockedCompareExchange SetComputerNameW SleepEx GetModuleHandleW GetTickCount GetWindowsDirectoryA EnumTimeFormatsW GlobalFindAtomA LoadLibraryW SizeofResource FormatMessageW GetVersionExW GetConsoleAliasesW GetLastError SetLastError BackupRead GetDateFormatW GetProcAddress VirtualAlloc BeginUpdateResourceW EnumDateFormatsExA SetComputerNameA SetTimerQueueTimer InterlockedExchangeAdd CreateFileMappingA LocalAlloc CreateFileMappingW HeapLock SetThreadIdealProcessor FoldStringA FindFirstVolumeMountPointA FindFirstChangeNotificationA OpenSemaphoreW SetFileShortNameA EndUpdateResourceA TerminateJobObject LCMapStringW lstrcpyA ReadConsoleOutputCharacterA GetFullPathNameW GetCommandLineA GetStartupInfoA SetUnhandledExceptionFilter Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement HeapCreate VirtualFree HeapFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection TerminateProcess UnhandledExceptionFilter IsDebuggerPresent LoadLibraryA InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage HeapAlloc HeapReAlloc RtlUnwind HeapSize GetLocaleInfoA LCMapStringA MultiByteToWideChar GetStringTypeA GetStringTypeW

user32

DdeQueryStringA

gdi32

SetDeviceGammaRamp

Sharing