file[.]exe | Triage™

Resubmissions

14/03/2024, 08:29

240314-kdjy1aeh6z10

05/02/2024, 10:15

240205-l984faddb410

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 5.6MB
Sample240205-l984faddb4
SHA256 42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d
MD5 d08e21ef739bcb9d74508790a6e6238f
SHA1 74576503141f26edab05ce2da89b66cb3bcf293b
SHA512 6ea1cd13b0bda1b69d0af26f073e2eb1eb2722b83a39c4b53148528fb88e09133ef7d095dc6617c5571e4a5248e0162f68afe13a4b1daa522797912a69b5dbee
SSDEEP 98304:eImo/NRpwP2DkKA+Ga5q73V41AmcR1Miq465iU7Fem+KOd8PbXLgKiOvG6ZB6Q3H:Xm0Rouq61i1U5Um+J+jkjEG6Zw
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 5.6MB

file.exe

IMPHASH 930dd563daeb0071b0a2e064c8e3b25f
SHA256 42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d
MD5 d08e21ef739bcb9d74508790a6e6238f
SHA1 74576503141f26edab05ce2da89b66cb3bcf293b
SHA512 6ea1cd13b0bda1b69d0af26f073e2eb1eb2722b83a39c4b53148528fb88e09133ef7d095dc6617c5571e4a5248e0162f68afe13a4b1daa522797912a69b5dbee
SSDEEP 98304:eImo/NRpwP2DkKA+Ga5q73V41AmcR1Miq465iU7Fem+KOd8PbXLgKiOvG6ZB6Q3H:Xm0Rouq61i1U5Um+J+jkjEG6Zw
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9655042

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InitializeCriticalSectionEx lstrlenA CreateMutexA WaitForSingleObject lstrcatA GetModuleHandleA SetCurrentDirectoryA Sleep GetModuleHandleExA GetFileAttributesA GetBinaryTypeA QueryFullProcessImageNameA GetSystemDirectoryA GlobalAlloc lstrcpyA SetFileAttributesA VerSetConditionMask WideCharToMultiByte VerifyVersionInfoW GetSystemTimeAsFileTime CreateEventA HeapFree HeapAlloc GetProcAddress lstrcpynA GetProcessHeap AreFileApisANSI TryEnterCriticalSection HeapCreate EnterCriticalSection GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection FindClose SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW GetFileAttributesW GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize MultiByteToWideChar GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesExW OutputDebugStringW FlushViewOfFile LoadLibraryA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc GetSystemInfo LoadLibraryW HeapCompact HeapDestroy UnlockFile LocalFree LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId SystemTimeToFileTime FreeLibrary GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers WriteConsoleW CloseHandle CreateFileA GetLastError CreateFileW SetFilePointer WriteFile GetFullPathNameA ReadFile SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP InitializeSListHead InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW GetModuleHandleW IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcess TerminateProcess GetLocaleInfoEx CreateDirectoryW FindFirstFileW FindFirstFileExW FindNextFileW GetFileInformationByHandleEx QueryPerformanceFrequency LCMapStringEx EncodePointer DecodePointer GetCPInfo GetStringTypeW SetLastError GetThreadTimes GetCurrentThread InterlockedPushEntrySList RaiseException RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW SetFilePointerEx GetFileType ExitProcess GetModuleHandleExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleFileNameW GetStdHandle GetConsoleMode ReadConsoleW GetConsoleOutputCP SetStdHandle CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx GetTimeZoneInformation IsValidCodePage VirtualQuery GetSystemTimeAsFileTime CreateEventA GetModuleHandleA TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep LoadLibraryA FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree HeapAlloc HeapFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection MultiByteToWideChar GetModuleHandleW LoadResource FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError GetCommandLineA GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException LCMapStringA LCMapStringW SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter HeapReAlloc GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize WriteFile RtlUnwind SetFilePointer GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA FlushFileBuffers VirtualQuery

user32

CharNextA

advapi32

RegCloseKey RegCreateKeyExA RegSetValueExA OpenProcessToken RegOpenKeyExA GetTokenInformation CryptReleaseContext

shell32

ShellExecuteA SHGetFolderPathA

ole32

CoCreateInstance CoInitializeEx CoUninitialize

Name

.text

Size

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp€�

Size

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp€�

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp€�

Size

5.4MB

Virtual Size

5.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

234KB

Virtual Size

233KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

kernel32

user32

advapi32

shell32

ole32

generic