file[.]exe | Triage™

General

Target
file.exe
Size 318KB
Sample240318-ld7whaea9w
SHA256 17f9ab3ff113a9dda69111ab6ab03c0da95d47ab419a858b54374e3333ce516b
MD5 87f42958b0558b85a4a799d76330eb89
SHA1 12621bd5045dae3d9f1afe6ea8a5363e5fe5ede8
SHA512 f3a44a108ae8f68525965e345420ecbca14e8a37c74fda78541fbe893dc537a9415a94b22d69118d6f3ac3eda3f0ff2545c58924c6cdd8f77b87d9769f2708ce
SSDEEP 3072:K+J2XhieipHjagnf+NHMGpbCccu9vp/R4e0Q/yfstLRRTSPi:KdFip+cwHM0HrD+e0Q/yfQtJ3
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 318KB

file.exe

IMPHASH 5428a38f0c6440648123ecccaabf4115
SHA256 17f9ab3ff113a9dda69111ab6ab03c0da95d47ab419a858b54374e3333ce516b
MD5 87f42958b0558b85a4a799d76330eb89
SHA1 12621bd5045dae3d9f1afe6ea8a5363e5fe5ede8
SHA512 f3a44a108ae8f68525965e345420ecbca14e8a37c74fda78541fbe893dc537a9415a94b22d69118d6f3ac3eda3f0ff2545c58924c6cdd8f77b87d9769f2708ce
SSDEEP 3072:K+J2XhieipHjagnf+NHMGpbCccu9vp/R4e0Q/yfstLRRTSPi:KdFip+cwHM0HrD+e0Q/yfQtJ3
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

45312

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetProcAddress GlobalAlloc VirtualProtect GetCurrentProcessId GetExitCodeThread GetLastError GetTickCount LoadLibraryA LoadLibraryW GetModuleFileNameA GetModuleHandleA SetEnvironmentVariableA FindResourceA GlobalFindAtomA GetWindowsDirectoryW GetCurrentDirectoryA CreateDirectoryA RemoveDirectoryW QueryDosDeviceW CreateFileA GetFileAttributesExA GetVolumeInformationW GetVersionExA FindNextVolumeMountPointW GetLocaleInfoA GetLocaleInfoW GetNumberFormatW EnumTimeFormatsA PeekConsoleInputW FreeConsole ReadConsoleA WriteConsoleW AddConsoleAliasA GetConsoleAliasExesLengthW CreateFileW GetStringTypeW SetFilePointerEx SetStdHandle OutputDebugStringW HeapReAlloc GetCPInfo EncodePointer DecodePointer HeapAlloc RaiseException RtlUnwind GetCommandLineA IsProcessorFeaturePresent HeapFree ExitProcess GetModuleHandleExW MultiByteToWideChar WideCharToMultiByte HeapSize GetStdHandle WriteFile GetModuleFileNameW GetProcessHeap EnterCriticalSection LeaveCriticalSection FlushFileBuffers GetConsoleCP GetConsoleMode DeleteCriticalSection IsDebuggerPresent GetFileType GetStartupInfoW SetLastError GetCurrentThreadId QueryPerformanceCounter GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW LCMapStringW LoadLibraryExW IsValidCodePage GetACP GetOEMCP CloseHandle

user32

CharLowerA CharUpperBuffW GetClassInfoW ActivateKeyboardLayout

winhttp

WinHttpOpen

Name

.text

Size

89KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

150KB

Virtual Size

41.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.guzibed

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.sise

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vevinom

Size

1024B

Virtual Size

723B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

66KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

kernel32

user32

winhttp

generic