file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 3.2MB
Sample231208-b9tnmsgf34
SHA256 f5a08f73ef4af60d8f89e5c5aa23cbcd112422868c311ffbfc18285510dd8079
MD5 4b1b489e8c63881db94bf759a6a1f32f
SHA1 25835117d0609881014ac5b9204b2ef636a3de60
SHA512 453cfe8321b6ae50f6eadaeaf77d380ba8ae7309849301b4efc5087fe7bfd85a3f8f05fb9d6b8683321ac854d6e5bb6aa31d7798f79cb15a86fb43b23c96e216
SSDEEP 98304:W9yTCqoAlUpvyi1axWS6Wnwz96yKLHgpl/H0fy8Lt1a:W9VqobyaaxWS6Iwz99KilT41a
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 3.2MB

file.exe

IMPHASH 1d0e3506c01cb61e9312cbea4911e92e
SHA256 f5a08f73ef4af60d8f89e5c5aa23cbcd112422868c311ffbfc18285510dd8079
MD5 4b1b489e8c63881db94bf759a6a1f32f
SHA1 25835117d0609881014ac5b9204b2ef636a3de60
SHA512 453cfe8321b6ae50f6eadaeaf77d380ba8ae7309849301b4efc5087fe7bfd85a3f8f05fb9d6b8683321ac854d6e5bb6aa31d7798f79cb15a86fb43b23c96e216
SSDEEP 98304:W9yTCqoAlUpvyi1axWS6Wnwz96yKLHgpl/H0fy8Lt1a:W9VqobyaaxWS6Iwz99KilT41a
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

105740

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

oleaut32

SysAllocStringLen VariantClear SysStringLen

user32

DialogBoxParamW SetWindowLongW GetWindowLongW GetDlgItem LoadStringW CharUpperW DestroyWindow EndDialog PostMessageW SetWindowTextW ShowWindow MessageBoxW SetTimer SendMessageW LoadIconW KillTimer

shell32

ShellExecuteExW

msvcrt

_controlfp __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit ?terminate@@YAXXZ ??1type_info@@UAE@XZ _except_handler3 _beginthreadex memset wcsstr free malloc memcpy _CxxThrowException _purecall memmove memcmp wcscmp __CxxFrameHandler

kernel32

GetStartupInfoA InitializeCriticalSection ReleaseSemaphore CreateSemaphoreW ResetEvent SetEvent CreateEventW lstrlenW lstrcatW VirtualFree VirtualAlloc Sleep GetStdHandle GlobalMemoryStatus GetSystemInfo GetCurrentProcess GetProcessAffinityMask SetEndOfFile WriteFile ReadFile SetFilePointer GetFileSize GetFileInformationByHandle GetFileAttributesW GetModuleHandleA FindNextFileW FindFirstFileW FindClose GetCurrentThreadId GetTickCount GetTempPathW GetCurrentDirectoryW SetCurrentDirectoryW SetLastError DeleteFileW CreateDirectoryW GetModuleHandleW GetProcAddress RemoveDirectoryW SetFileAttributesW CreateFileW SetFileTime GetSystemDirectoryW GetCurrentProcessId FormatMessageW LocalFree GetModuleFileNameW LoadLibraryExW DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLastError GetVersionExW GetCommandLineW CreateProcessW CloseHandle WaitForSingleObject