file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 235KB
Sample231209-snfnbsaef3
SHA256 3d773165469c51d2ae4efc9dece1dd21f7cf302ae7feb36f6dc4989ee5aa375d
MD5 8bb19cf3fa450a3ec223fdf5c888d464
SHA1 5c75efac4b174fff78b1c42ec54378ce3b14f2f5
SHA512 1713605786e11df4e647aa515b8416c4f047753615bc47a06a7ed6c6b78f6cda8f2be288cfe3b7096170af82d4ec7bef208f7c835a0e0184aef16a16fcaec24d
SSDEEP 3072:zv2LcAcZahUoiaztRKAXH6tR+kKSR1eCvV7RTSz/HIf89/:yLcAcZayoiYRRdO1HCskp
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 235KB

file.exe

IMPHASH 72379c5ddf565101cdb428c327a6a6d3
SHA256 3d773165469c51d2ae4efc9dece1dd21f7cf302ae7feb36f6dc4989ee5aa375d
MD5 8bb19cf3fa450a3ec223fdf5c888d464
SHA1 5c75efac4b174fff78b1c42ec54378ce3b14f2f5
SHA512 1713605786e11df4e647aa515b8416c4f047753615bc47a06a7ed6c6b78f6cda8f2be288cfe3b7096170af82d4ec7bef208f7c835a0e0184aef16a16fcaec24d
SSDEEP 3072:zv2LcAcZahUoiaztRKAXH6tR+kKSR1eCvV7RTSz/HIf89/:yLcAcZayoiYRRdO1HCskp
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8114

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

TlsGetValue SystemTimeToTzSpecificLocalTime EndUpdateResourceW InterlockedIncrement GetCurrentProcess CreateJobObjectW GetTickCount GetConsoleAliasesLengthA GetWindowsDirectoryA EnumTimeFormatsA GlobalAlloc SetFileShortNameW GlobalFindAtomA Sleep AssignProcessToJobObject SizeofResource GetSystemWindowsDirectoryA CreateFileW GetOverlappedResult GetVolumePathNameA InterlockedExchange GetLastError SetLastError BackupRead FindFirstChangeNotificationW GetProcessHeaps VirtualAlloc BeginUpdateResourceW EnumDateFormatsExA SetComputerNameA SetFileApisToOEM LoadLibraryA InterlockedExchangeAdd CreateFileMappingW FindFirstVolumeMountPointW SetConsoleWindowInfo FoldStringA FindFirstVolumeMountPointA GetModuleHandleA VirtualProtect OpenSemaphoreW GetVersionExA GlobalAddAtomW ReadConsoleOutputCharacterW LCMapStringW GetFullPathNameA GetDateFormatW GetProcAddress GetComputerNameA CreateFileA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA CloseHandle SetFilePointer UnhandledExceptionFilter SetUnhandledExceptionFilter GetModuleHandleW ExitProcess GetStartupInfoW WriteFile GetStdHandle GetModuleFileNameA TlsAlloc TlsSetValue TlsFree GetCurrentThreadId InterlockedDecrement HeapSize EnterCriticalSection LeaveCriticalSection TerminateProcess IsDebuggerPresent HeapFree DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage HeapAlloc HeapReAlloc RtlUnwind WideCharToMultiByte GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW LCMapStringA GetConsoleCP GetConsoleMode FlushFileBuffers

user32

GetWindowTextLengthW

gdi32

SetDeviceGammaRamp

advapi32

ReadEventLogA

shell32

ShellAboutW

ole32

CoRegisterPSClsid

winhttp

WinHttpCheckPlatform

msimg32

AlphaBlend