file[.]exe | Triage™

General

Target
file.exe
Size 267KB
Sample240330-lc2cbscd6z
SHA256 083c9a8679034f65137bce38b2f1db98225a8d1f18dc351ee4d5adfc464fa72b
MD5 8b2f1a0f480177fe032cbf896442a44e
SHA1 96099aced1b2724dd7fc56f6978802b87aeebaab
SHA512 ca454ca2e172f1ec7d1cf22a2c2a3085692c1ff58a3c37e83cfbbc87623702879b9e2d0fe3a17dd609bcfe5ed5daf9181219ec0f0ecacacaf6136fd1b73758be
SSDEEP 3072:8LZMm58BE5RRc8+HBi1/G66Czp+lbWhXrcrB0F0VC2MZUrTTk3:8KEVc8dH6ColYrcrB0F0k2MZmTT
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 267KB

file.exe

IMPHASH 624073eb8eb5db9d6388daa3da73856e
SHA256 083c9a8679034f65137bce38b2f1db98225a8d1f18dc351ee4d5adfc464fa72b
MD5 8b2f1a0f480177fe032cbf896442a44e
SHA1 96099aced1b2724dd7fc56f6978802b87aeebaab
SHA512 ca454ca2e172f1ec7d1cf22a2c2a3085692c1ff58a3c37e83cfbbc87623702879b9e2d0fe3a17dd609bcfe5ed5daf9181219ec0f0ecacacaf6136fd1b73758be
SSDEEP 3072:8LZMm58BE5RRc8+HBi1/G66Czp+lbWhXrcrB0F0VC2MZUrTTk3:8KEVc8dH6ColYrcrB0F0k2MZmTT
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

14587

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\laya\nodihahi\wiwumuhi-biguheralorewe_kekocexih miy.pdb

kernel32

SetHandleInformation _lcreat GetTickCount GetConsoleAliasesLengthA GlobalAlloc GlobalFindAtomA SetCommConfig GetLocaleInfoW ReadConsoleInputA GetSystemPowerStatus GetConsoleAliasExesLengthW GetVersionExW FindNextVolumeW GetConsoleAliasW GetWriteWatch WriteConsoleW CreateFileW GetEnvironmentVariableA ExitThread GetLastError ChangeTimerQueueTimer ReadConsoleA LoadLibraryA FindFirstVolumeMountPointW SetConsoleCtrlHandler GetNumberFormatW RemoveDirectoryW SetFileApisToANSI QueryDosDeviceW GetModuleFileNameA VirtualProtect GetCurrentDirectoryA CompareStringA PeekConsoleInputA GetWindowsDirectoryW GetTempPathA WriteProcessMemory GetVolumeInformationW GetStringTypeW OutputDebugStringW FlushFileBuffers FindResourceW InterlockedIncrement GetProcAddress GetLocaleInfoA IsProcessorFeaturePresent EncodePointer DecodePointer ReadFile GetCommandLineA RaiseException RtlUnwind ExitProcess GetModuleHandleExW MultiByteToWideChar WideCharToMultiByte IsDebuggerPresent HeapSize HeapFree EnterCriticalSection LeaveCriticalSection SetFilePointerEx GetConsoleMode GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW SetLastError GetCurrentThreadId HeapAlloc GetProcessHeap WriteFile GetModuleFileNameW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW LoadLibraryExW IsValidCodePage GetACP GetOEMCP GetCPInfo HeapReAlloc LCMapStringW SetStdHandle GetConsoleCP CloseHandle

user32

CharUpperBuffA DrawCaption

gdi32

SetTextColor

advapi32

ReadEventLogW

Sharing