file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 3.2MB
Sample231208-gcvsbshd93
SHA256 1369e2566772026aa4aac1742987ddb70daadd8cd58d0e71e31b219657d9545a
MD5 1dcd373721b559a276280b1e63491635
SHA1 a1d75e8204b43114c4a2124c778db02cddfe9b0c
SHA512 70d8a841505f25cb368b7872cc16175bc178e7dd2d14fa4f895f0304e09b7c28f18b6e5513f7b3e40e7808345fa2fc1383f2f53f618af5e465e5c2750fa1e400
SSDEEP 49152:B8G/M37/HyHUTgvEcalqjWiyJ61UWD0IdxWozu1QA52ZgeDPGti8bdJFqaenR:B8GGHllpSUWD0kxnS1QA2LZ87FqaeR
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 3.2MB

file.exe

IMPHASH 94af7f0728c275a2ef6a6a6c552117f9
SHA256 1369e2566772026aa4aac1742987ddb70daadd8cd58d0e71e31b219657d9545a
MD5 1dcd373721b559a276280b1e63491635
SHA1 a1d75e8204b43114c4a2124c778db02cddfe9b0c
SHA512 70d8a841505f25cb368b7872cc16175bc178e7dd2d14fa4f895f0304e09b7c28f18b6e5513f7b3e40e7808345fa2fc1383f2f53f618af5e465e5c2750fa1e400
SSDEEP 49152:B8G/M37/HyHUTgvEcalqjWiyJ61UWD0IdxWozu1QA52ZgeDPGti8bdJFqaenR:B8GGHllpSUWD0kxnS1QA2LZ87FqaeR
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

92114

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

oleaut32

SysAllocStringLen VariantClear SysStringLen

user32

DialogBoxParamW SetWindowLongW GetWindowLongW GetDlgItem LoadStringW CharUpperW DestroyWindow EndDialog PostMessageW SetWindowTextW ShowWindow MessageBoxW SetTimer SendMessageW LoadIconW KillTimer

shell32

ShellExecuteExW

msvcrt

_controlfp __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit ?terminate@@YAXXZ ??1type_info@@UAE@XZ _except_handler3 _beginthreadex wcsstr free malloc memcpy _CxxThrowException _purecall memmove memcmp wcscmp __CxxFrameHandler memset

kernel32

GetStartupInfoA InitializeCriticalSection ResetEvent SetEvent CreateEventW lstrlenW lstrcatW VirtualFree VirtualAlloc Sleep WaitForMultipleObjects GetFileInformationByHandle GetStdHandle SetEndOfFile WriteFile ReadFile SetFilePointer GetFileSize GetFileAttributesW GetModuleHandleA FindNextFileW FindFirstFileW FindClose GetCurrentThreadId GetTickCount GetCurrentProcessId GetTempPathW GetCurrentDirectoryW SetLastError DeleteFileW CreateDirectoryW GetModuleHandleW GetProcAddress RemoveDirectoryW SetFileAttributesW CreateFileW SetFileTime GetSystemDirectoryW FormatMessageW LocalFree SetCurrentDirectoryW GetModuleFileNameW LoadLibraryExW DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLastError GetVersionExW GetCommandLineW CreateProcessW CloseHandle WaitForSingleObject