file[.]exe | Triage™

General

Target
file.exe
Size 312KB
Sample240110-vxjsfscfe8
SHA256 11d22d4281f0d9b237379e7bc5b2f301ae94f9028d94d043cefe1c08636ce9fd
MD5 cc6e4705b5dd5aabaf9378883a692ff8
SHA1 5059661206ee4ad89aa98faf233c8266f59855cb
SHA512 8ddb82f5d10da172fc00aa67ade3aa0af9c712bb3728691044e423de972094725645ef5d57da998c91ce235fe710a1f0024378bf14d7710c423a7f01949708a0
SSDEEP 6144:BfW0Ljy09BsHLDaitSPQHpL7sEE3eOpW:BfW0/y09BsSGSAUEE3eY
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 312KB

file.exe

IMPHASH 7b1df25cb3b9a53041bb12b024d69535
SHA256 11d22d4281f0d9b237379e7bc5b2f301ae94f9028d94d043cefe1c08636ce9fd
MD5 cc6e4705b5dd5aabaf9378883a692ff8
SHA1 5059661206ee4ad89aa98faf233c8266f59855cb
SHA512 8ddb82f5d10da172fc00aa67ade3aa0af9c712bb3728691044e423de972094725645ef5d57da998c91ce235fe710a1f0024378bf14d7710c423a7f01949708a0
SSDEEP 6144:BfW0Ljy09BsHLDaitSPQHpL7sEE3eOpW:BfW0/y09BsSGSAUEE3eY
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

8858

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LocalUnlock TlsGetValue HeapFree FreeEnvironmentStringsA GetModuleHandleW GetConsoleAliasesA LoadLibraryW GetLocaleInfoW GetAtomNameW CompareStringW LCMapStringA GetConsoleOutputCP GetLastError GetProcAddress GetLongPathNameA CreateNamedPipeA SetComputerNameA OpenWaitableTimerA LoadLibraryA LocalAlloc SetCurrentDirectoryW VirtualLock FindAtomA GetModuleFileNameA CreateWaitableTimerW DebugBreakProcess DeleteCriticalSection LocalFree SetFileAttributesW GetStartupInfoW RaiseException RtlUnwind TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCurrentThread Sleep HeapSize ExitProcess WriteFile GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection FatalAppExitA EnterCriticalSection VirtualAlloc HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage SetConsoleCtrlHandler FreeLibrary InterlockedExchange InitializeCriticalSectionAndSpinCount GetTimeFormatA GetDateFormatA GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA MultiByteToWideChar GetStringTypeW WideCharToMultiByte LCMapStringW GetTimeZoneInformation CompareStringA SetEnvironmentVariableA

Name

.text

Size

212KB

Virtual Size

212KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

33KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.kakapez

Size

512B

Virtual Size

124B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

417B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

kernel32

generic