file[.]exe | Triage™

General

Target
file.exe
Size 230KB
Sample231208-w92pgabgel
SHA256 f7f44a469cdf8049c9da6fb5b1e2fdbb4e3d1cf2f09ef0eba5889dea7ef80a97
MD5 02a45302c305c0747c87ccf5620c12c0
SHA1 1877ec0041c687feb85bd18b2e42ee10189e53b2
SHA512 38ef597ff5ffa8a870120ed8de91e53dff3898bd2db277c7b57a47a477f8f73fb1f1416e3d5e3dce7e85b1201ad4098385db6599ca1e563a2c2b942a54cc4bc2
SSDEEP 3072:hzrQGih+g51CO6HE5MSdoJ8A7NcQHRbIoGiWHCK:mGu+wzquG8aNzVIBH
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 230KB

file.exe

IMPHASH c5c445b50fcdfbfd65e18ac43adc31c9
SHA256 f7f44a469cdf8049c9da6fb5b1e2fdbb4e3d1cf2f09ef0eba5889dea7ef80a97
MD5 02a45302c305c0747c87ccf5620c12c0
SHA1 1877ec0041c687feb85bd18b2e42ee10189e53b2
SHA512 38ef597ff5ffa8a870120ed8de91e53dff3898bd2db277c7b57a47a477f8f73fb1f1416e3d5e3dce7e85b1201ad4098385db6599ca1e563a2c2b942a54cc4bc2
SSDEEP 3072:hzrQGih+g51CO6HE5MSdoJ8A7NcQHRbIoGiWHCK:mGu+wzquG8aNzVIBH
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

16403

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetNativeSystemInfo FindFirstChangeNotificationW TlsGetValue SystemTimeToTzSpecificLocalTime GlobalAddAtomA EndUpdateResourceW InterlockedIncrement GetCurrentProcess CreateJobObjectW SetComputerNameW GetComputerNameW OpenSemaphoreA GetModuleHandleW GetTickCount GetConsoleAliasesLengthA GetWindowsDirectoryA EnumTimeFormatsW GlobalAlloc SetFileShortNameW GlobalFindAtomA Sleep SizeofResource GetConsoleAliasExesLengthW FormatMessageW GetDateFormatW CreateFileW LCMapStringA InterlockedExchange GetLastError SetLastError BackupRead GetProcAddress VirtualAlloc BeginUpdateResourceW EnumDateFormatsExA LoadLibraryA InterlockedExchangeAdd CreateFileMappingW FindFirstVolumeMountPointW HeapLock FoldStringA FindFirstVolumeMountPointA VirtualProtect GetVersionExA TerminateJobObject DeleteTimerQueueTimer ReadConsoleOutputCharacterW SetConsoleCursorPosition GetFullPathNameW UnhandledExceptionFilter SetUnhandledExceptionFilter ExitProcess GetCommandLineA GetStartupInfoA WriteFile GetStdHandle GetModuleFileNameA TlsAlloc TlsSetValue TlsFree GetCurrentThreadId InterlockedDecrement HeapSize EnterCriticalSection LeaveCriticalSection TerminateProcess IsDebuggerPresent HeapFree DeleteCriticalSection InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage HeapAlloc HeapReAlloc RtlUnwind GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW LCMapStringW GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer CloseHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA RaiseException

gdi32

SetDeviceGammaRamp

Sharing