file[.]exe | Triage™

General

Target
file.exe
Size 313KB
Sample240322-g67c8ahe75
SHA256 abc5152266564f883ab915f2a1eec762cd98920e5e315974c926632942e31976
MD5 49c1a7094df766b5e5868811f298b529
SHA1 c48fc045b5ee06e02d558f3c3551a463199725b9
SHA512 c34cf47f715fffb4c4b9ec4ba587ea0c455d3baf7192408114b9f7260dbb1ee6b28c794157cfdd12c6048e99e9140220d77232bd9355cb96db7df9e566ba9490
SSDEEP 3072:9gw3B7c4wkQMR+BYYeEX+qP4XTkedBoRv0XgGlf+N9XF6kVQvVYKAG:zxd/RmFMkeAv0ltKXF6k2NvJ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 313KB

file.exe

IMPHASH 1d363a16825484f3b256f5ef2aeceb2c
SHA256 abc5152266564f883ab915f2a1eec762cd98920e5e315974c926632942e31976
MD5 49c1a7094df766b5e5868811f298b529
SHA1 c48fc045b5ee06e02d558f3c3551a463199725b9
SHA512 c34cf47f715fffb4c4b9ec4ba587ea0c455d3baf7192408114b9f7260dbb1ee6b28c794157cfdd12c6048e99e9140220d77232bd9355cb96db7df9e566ba9490
SSDEEP 3072:9gw3B7c4wkQMR+BYYeEX+qP4XTkedBoRv0XgGlf+N9XF6kVQvVYKAG:zxd/RmFMkeAv0ltKXF6k2NvJ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

14584

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetConsoleAliasExesLengthA InterlockedDecrement GetTickCount FindNextVolumeMountPointA ReadConsoleW GetWindowsDirectoryA EnumTimeFormatsA GlobalAlloc WideCharToMultiByte GetVolumeInformationA GlobalFindAtomA GetLocaleInfoW GetSystemPowerStatus GetVersionExW GetConsoleAliasW WriteConsoleW CreateFileW GetEnvironmentVariableA ExitThread GetLocaleInfoA GetCurrentDirectoryW ReadConsoleOutputCharacterA GetProcAddress LoadLibraryA SetConsoleCtrlHandler GetNumberFormatW RemoveDirectoryW QueryDosDeviceW GetModuleFileNameA GetModuleHandleA VirtualProtect PeekConsoleInputA GetCurrentProcessId CloseHandle SetStdHandle OutputDebugStringW LoadLibraryExW HeapReAlloc GetLastError FindResourceA EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection MultiByteToWideChar GetStringTypeW HeapFree HeapAlloc GetCommandLineA RaiseException RtlUnwind GetCPInfo IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW LCMapStringW IsDebuggerPresent GetStdHandle GetFileType GetProcessHeap ExitProcess GetModuleHandleExW WriteFile GetModuleFileNameW FlushFileBuffers GetConsoleCP GetConsoleMode HeapSize GetCurrentThreadId ReadFile SetFilePointerEx QueryPerformanceCounter GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW GetACP IsValidCodePage GetOEMCP

user32

GetUserObjectSecurity CharLowerA GetAltTabInfoA GetClassInfoA DrawFrameControl CharUpperBuffW

advapi32

ReadEventLogW

Sharing