file[.]exe | Triage™

General

Target
file.exe
Size 253KB
Sample231207-hnnzlabcc8
SHA256 94681ea471533efd3e296b1ea1c84a028d634236f66d15a79a5ac5f95d68cab9
MD5 7cd8ce34987c3ec8c4b092580282c75d
SHA1 eb4abbc7a1b9829b5ed4dfe11527c30c69e35b3d
SHA512 37ad03baf38d6eaa3149925b5edf271848ada6cf93a99b4424a002d5673f5b3570b712c65aec98e29da715bf685bd09421fec19f4c9e19073c8b118e7fe55c18
SSDEEP 3072:z0TiNhvbyM2c8WYR+256Qh5eBK47Vdbzw7q:achwMIT6QYD
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 253KB

file.exe

IMPHASH 7cf7340480a4671d2b97fbdd19307acc
SHA256 94681ea471533efd3e296b1ea1c84a028d634236f66d15a79a5ac5f95d68cab9
MD5 7cd8ce34987c3ec8c4b092580282c75d
SHA1 eb4abbc7a1b9829b5ed4dfe11527c30c69e35b3d
SHA512 37ad03baf38d6eaa3149925b5edf271848ada6cf93a99b4424a002d5673f5b3570b712c65aec98e29da715bf685bd09421fec19f4c9e19073c8b118e7fe55c18
SSDEEP 3072:z0TiNhvbyM2c8WYR+256Qh5eBK47Vdbzw7q:achwMIT6QYD
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

16795

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateFileA GetNativeSystemInfo FindFirstChangeNotificationW TlsGetValue GetConsoleAliasExesLengthA SystemTimeToTzSpecificLocalTime GetCurrentProcess SetConsoleScreenBufferSize InterlockedCompareExchange SetComputerNameW SleepEx GetModuleHandleW GetTickCount GetConsoleAliasesA GetWindowsDirectoryA EnumTimeFormatsW GlobalFindAtomA LoadLibraryW SizeofResource FormatMessageW GetVersionExW CreateJobObjectA LCMapStringA GetLastError GetDateFormatW BackupRead ReadConsoleOutputCharacterA GetProcAddress VirtualAlloc EnumDateFormatsExA SetComputerNameA SetTimerQueueTimer InterlockedExchangeAdd LocalAlloc CreateFileMappingW FindFirstVolumeMountPointW BeginUpdateResourceA HeapLock FoldStringA FindFirstVolumeMountPointA OpenSemaphoreW SetFileShortNameA EndUpdateResourceA TerminateJobObject GlobalAddAtomW SetLastError GetFullPathNameW InterlockedIncrement InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter HeapFree TerminateProcess IsDebuggerPresent ExitProcess GetCommandLineA GetStartupInfoA RtlUnwind WideCharToMultiByte MultiByteToWideChar LCMapStringW GetCPInfo WriteFile GetStdHandle GetModuleFileNameA HeapAlloc HeapCreate VirtualFree HeapReAlloc TlsAlloc TlsSetValue TlsFree GetCurrentThreadId HeapSize LoadLibraryA InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetACP GetOEMCP IsValidCodePage GetLocaleInfoA GetStringTypeA GetStringTypeW GetModuleHandleA GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer CloseHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle

user32

DdeQueryStringA

gdi32

SetDeviceGammaRamp

Resubmissions

Sharing