file[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

file.exe
Size

1.8MB
MD5

9c7cad9eda9e00f3ab502d8f02cba2ca
SHA1

a249034719737a3d6f4adda631e72c2145787949
SHA256

842360492263c33b06bbe3d241a035b29bf29900066d29b3267f000eee07e6a2
SHA512

7892319b2872dec33031ab4a50efd2de5bf0a58641a011c091c57eaa62dc9957acd82765bfecec60a656736a79328c5fa1ef4733456bde3160ffc3cadffe712e
SSDEEP

24576:s7p3zW7nsL1lzFGE64M3ICpoy5hn5TbtgqzHNJltNupD2m9dDZYK:sV3zHXS3VpNh5TJgqrNJl4CEdGK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

file.exe

resource
file.exe

Files

file.exe
.exe windows:4 windows x86 arch:x86

b19e1d3d44a26eecf665272334f346d2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FreeEnvironmentStringsW
GetEnvironmentStringsW
GetEnvironmentStrings
GetCommandLineW
GetCommandLineA
SetHandleCount
GetStdHandle
GetStartupInfoA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
CompareStringA
CompareStringW
VirtualAlloc
IsBadWritePtr
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
GetCurrentDirectoryA
FreeEnvironmentStringsA
IsBadReadPtr
IsBadCodePtr
GetCPInfo
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeA
GetStringTypeW
CreateFileA
GetACP
GetOEMCP
SetEnvironmentVariableA
GetDriveTypeA
UnhandledExceptionFilter
HeapSize
FindResourceA
GlobalAddAtomA
GetProfileStringA
InterlockedExchange
GetFileType
SetStdHandle
GetLocalTime
GetSystemTime
GetTimeZoneInformation
ExitThread
HeapReAlloc
RaiseException
HeapFree
HeapAlloc
RtlUnwind
GetStartupInfoW
SetErrorMode
SystemTimeToFileTime
LocalFileTimeToFileTime
GetFileSize
FindResourceExW
GetCurrentDirectoryW
GlobalFlags
FindNextFileW
lstrcmpiW
GetThreadLocale
GetStringTypeExW
GetVolumeInformationW
FindFirstFileW
FindClose
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
CreateFileW
DuplicateHandle
FileTimeToLocalFileTime
FileTimeToSystemTime
GetProfileIntW
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
GetProcessVersion
GetDiskFreeSpaceW
GetFileTime
SetFileTime
GetFullPathNameW
GetTempFileNameW
GetFileAttributesW
SuspendThread
lstrcmpW
lstrcmpA
lstrcmpiA
GetCurrentThread
GlobalGetAtomNameW
MulDiv
SetLastError
GlobalFree
InterlockedDecrement
InterlockedIncrement
GetModuleHandleA
LoadLibraryA
GetVersion
lstrcatW
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
lstrcpyW
lstrlenA
ExitProcess
GlobalAlloc
GlobalLock
GlobalUnlock
SizeofResource
LoadResource
LockResource
SetCurrentDirectoryW
WritePrivateProfileStringW
GetPrivateProfileIntW
GetPrivateProfileStringW
SetThreadPriority
MultiByteToWideChar
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetWindowsDirectoryW
GetModuleFileNameW
LoadLibraryW
FreeLibrary
GetCurrentProcess
GetTempPathW
FindResourceW
CreateDirectoryW
GetFileAttributesExW
GetLongPathNameW
GetShortPathNameW
GetLocaleInfoW
GetNumberFormatW
GetLastError
LocalFree
MoveFileW
DeleteFileW
Sleep
CreateProcessW
TerminateProcess
GetExitCodeProcess
GetCurrentThreadId
GetModuleHandleW
GetProcAddress
GetVersionExW
CloseHandle
CreateEventW
CreateThread
WaitForMultipleObjects
SetEvent
lstrcpynW
GetDriveTypeW
WaitForSingleObject
ResumeThread
GetTickCount
lstrlenW
WideCharToMultiByte

user32

ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
IsDlgButtonChecked
SetDlgItemTextW
GetDlgItemInt
SendDlgItemMessageW
SendDlgItemMessageA
MapWindowPoints
EqualRect
DeferWindowPos
GetTopWindow
MessageBoxW
WinHelpW
wsprintfW
GetClassInfoW
RegisterClassW
TrackPopupMenu
SetWindowPlacement
GetWindowTextLengthW
GetWindowTextW
DestroyWindow
CreateWindowExW
DefWindowProcW
GetMessageTime
GetMessagePos
GetLastActivePopup
GetForegroundWindow
SystemParametersInfoW
GetWindowPlacement
GetDlgCtrlID
IsChild
AdjustWindowRectEx
SetWindowPos
CheckMenuItem
GetMenu
SetMenu
IsIconic
FindWindowW
ExitWindowsEx
DestroyIcon
GetMessageW
PeekMessageW
TranslateMessage
DispatchMessageW
InsertMenuW
GetMenuStringW
CallNextHookEx
keybd_event
SetWindowsHookExW
TrackPopupMenuEx
UnhookWindowsHookEx
GetMenuItemCount
WindowFromPoint
DestroyMenu
SetRect
GetCapture
ReleaseCapture
SetCapture
IntersectRect
IsRectEmpty
SetRectEmpty
GetDC
ReleaseDC
DrawFocusRect
SetCursor
GetFocus
IsWindowEnabled
SetFocus
RegisterWindowMessageW
GetWindow
DrawIconEx
FrameRect
FillRect
SendMessageW
IsWindow
UnregisterClassW
GetDlgItem
GetWindowTextLengthA
HideCaret
ShowCaret
ExcludeUpdateRgn
GetSysColor
CreatePopupMenu
RemovePropW
GetPropW
CallWindowProcW
GetWindowLongW
SetPropW
SetWindowLongW
GetMenuItemID
GetMenuDefaultItem
BeginDeferWindowPos
OffsetRect
EndDeferWindowPos
GetSystemMenu
LoadIconW
KillTimer
SetTimer
SetParent
InflateRect
GetClassNameW
CharUpperW
GetDCEx
GetSysColorBrush
wvsprintfW
MapDialogRect
GetAsyncKeyState
ValidateRect
ShowOwnedPopups
PostQuitMessage
BringWindowToTop
UnpackDDElParam
ReuseDDElParam
ClientToScreen
SetMenuDefaultItem
LoadMenuW
GrayStringW
DrawTextW
TabbedTextOutW
ScreenToClient
GetSubMenu
CopyRect
LoadBitmapW
UpdateWindow
LockWindowUpdate
GetClientRect
GetSystemMetrics
SetActiveWindow
SetForegroundWindow
DestroyCursor
LoadCursorW
InvalidateRect
IsWindowVisible
GetWindowRect
GetCursorPos
PtInRect
GetKeyState
DeleteMenu
GetWindowTextA
DrawTextA
GetClassInfoA
DefDlgProcA
DefWindowProcA
GetDesktopWindow
TranslateAcceleratorW
LoadAcceleratorsW
CharNextA
CallWindowProcA
RemovePropA
EndPaint
BeginPaint
GetWindowDC
LoadStringW
EndDialog
GetActiveWindow
CreateDialogIndirectParamW
GetMenuCheckMarkDimensions
GetMenuState
ModifyMenuW
SetMenuItemBitmaps
EnableMenuItem
RedrawWindow
GetNextDlgTabItem
SetWindowsHookExA
GetWindowLongA
SendMessageA
IsWindowUnicode
GetClassNameA
SetWindowLongA
SetPropA
GetPropA
PostMessageW
GetParent
EnableWindow
CheckMenuRadioItem

gdi32

SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
SelectClipRgn
IntersectClipRect
GetDeviceCaps
CreatePen
CreatePatternBrush
SetRectRgn
GetTextMetricsW
EnumFontFamiliesExW
CreateRectRgn
CombineRgn
SetTextColor
SetBkMode
CreateBitmap
SetBkColor
SaveDC
GetClipBox
CreateRectRgnIndirect
ExtSelectClipRgn
SetStretchBltMode
StretchDIBits
SetDIBitsToDevice
RestoreDC
CreateDIBSection
DeleteDC
PatBlt
SelectObject
GetBkMode
GetBkColor
GetTextExtentPoint32W
DeleteObject
CreateSolidBrush
GetTextColor
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
GetStockObject
GetObjectW
CreateDIBitmap
ExtTextOutA
GetTextExtentPointA
CreateFontIndirectW

comdlg32

GetFileTitleW
GetOpenFileNameW
GetSaveFileNameW

advapi32

RegCloseKey
RegQueryValueW
RegSetValueExW
RegCreateKeyW
RegSetValueW
RegDeleteKeyW
RegEnumKeyW
RegOpenKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegOpenKeyExW
RegCreateKeyExW
RegQueryValueExW
RegDeleteValueW
SetFileSecurityW
GetFileSecurityW
RegEnumKeyExW

shell32

SHGetMalloc
SHGetDesktopFolder
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
ExtractIconW
SHFileOperationW
SHGetSpecialFolderPathW
DragAcceptFiles
DragQueryFileW
SHGetSpecialFolderLocation
DragFinish

ole32

CoUninitialize
CoCreateInstance
CoInitialize
CoCreateGuid

oleaut32

SysFreeString
SysAllocString

Sections

.text
Size: 848KB - Virtual size: 847KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 132KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 88KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 500KB - Virtual size: 496KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.itext
Size: 224KB - Virtual size: 221KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.aurore
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.chiho
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.callie
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.bianca
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.essie
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.deb
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.glenine
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.amandie
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.britta
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.azhar
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eirena
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.engin
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.etta
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.ghassan
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.filion
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.alfy
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.elberti
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hossein
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.cassaun
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.allx
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.camila
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eula
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.cefee
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.deirdre
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b19e1d3d44a26eecf665272334f346d2

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 848KB - Virtual size: 847KB

.rdata Size: 132KB - Virtual size: 129KB

.data Size: 88KB - Virtual size: 103KB

.rsrc Size: 500KB - Virtual size: 496KB

.itext Size: 224KB - Virtual size: 221KB

.aurore Size: 4KB - Virtual size: 4KB

.chiho Size: 4KB - Virtual size: 4KB

.callie Size: 4KB - Virtual size: 4KB

.bianca Size: 4KB - Virtual size: 4KB

.essie Size: 4KB - Virtual size: 4KB

.deb Size: 4KB - Virtual size: 4KB

.glenine Size: 4KB - Virtual size: 4KB

.amandie Size: 4KB - Virtual size: 4KB

.britta Size: 4KB - Virtual size: 4KB

.azhar Size: 4KB - Virtual size: 4KB

.eirena Size: 4KB - Virtual size: 4KB

.engin Size: 4KB - Virtual size: 4KB

.etta Size: 4KB - Virtual size: 4KB

.ghassan Size: 4KB - Virtual size: 4KB

.filion Size: 4KB - Virtual size: 4KB

.alfy Size: 4KB - Virtual size: 4KB

.elberti Size: 4KB - Virtual size: 4KB

.hossein Size: 4KB - Virtual size: 4KB

.cassaun Size: 4KB - Virtual size: 4KB

.allx Size: 4KB - Virtual size: 4KB

.camila Size: 4KB - Virtual size: 4KB

.eula Size: 4KB - Virtual size: 4KB

.cefee Size: 4KB - Virtual size: 4KB

.deirdre Size: 4KB - Virtual size: 4KB

.text
Size: 848KB - Virtual size: 847KB

.rdata
Size: 132KB - Virtual size: 129KB

.data
Size: 88KB - Virtual size: 103KB

.rsrc
Size: 500KB - Virtual size: 496KB

.itext
Size: 224KB - Virtual size: 221KB

.aurore
Size: 4KB - Virtual size: 4KB

.chiho
Size: 4KB - Virtual size: 4KB

.callie
Size: 4KB - Virtual size: 4KB

.bianca
Size: 4KB - Virtual size: 4KB

.essie
Size: 4KB - Virtual size: 4KB

.deb
Size: 4KB - Virtual size: 4KB

.glenine
Size: 4KB - Virtual size: 4KB

.amandie
Size: 4KB - Virtual size: 4KB

.britta
Size: 4KB - Virtual size: 4KB

.azhar
Size: 4KB - Virtual size: 4KB

.eirena
Size: 4KB - Virtual size: 4KB

.engin
Size: 4KB - Virtual size: 4KB

.etta
Size: 4KB - Virtual size: 4KB

.ghassan
Size: 4KB - Virtual size: 4KB

.filion
Size: 4KB - Virtual size: 4KB

.alfy
Size: 4KB - Virtual size: 4KB

.elberti
Size: 4KB - Virtual size: 4KB

.hossein
Size: 4KB - Virtual size: 4KB

.cassaun
Size: 4KB - Virtual size: 4KB

.allx
Size: 4KB - Virtual size: 4KB

.camila
Size: 4KB - Virtual size: 4KB

.eula
Size: 4KB - Virtual size: 4KB

.cefee
Size: 4KB - Virtual size: 4KB

.deirdre
Size: 4KB - Virtual size: 4KB