user[.]exe | Triage™

General

Target
user.exe
Size 299KB
Sample240331-pgcrbabb9t
SHA256 9ee681ec9e50f3083c9cd6464752e48fa08541cd7e11adc6bc0f78d113b6f939
MD5 665993617d6fbf2ad539460d415cfc93
SHA1 9dc6f8ce941f67d36b7ea8cf5d885acf85cc893e
SHA512 fb973888897e4e8de83e8b4d9797e1a08adc68415d1f8a61dea0b3aad884dd9ebf3543d5e1761a0c65802e67dec9aa00166e3d27f6581756f37257a3ac3082d1
SSDEEP 6144:lzN72vG2VrrHhoKS9/NSEAt9xsv7c41FW3HuDw1yC7F3:lkrrHhoK1FsTc410XusRx
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
user.exe

File Explorer

user.exe

.exe 299KB

user.exe

IMPHASH f198d8abcbaf81c3dd60f47e8f08fb69
SHA256 9ee681ec9e50f3083c9cd6464752e48fa08541cd7e11adc6bc0f78d113b6f939
MD5 665993617d6fbf2ad539460d415cfc93
SHA1 9dc6f8ce941f67d36b7ea8cf5d885acf85cc893e
SHA512 fb973888897e4e8de83e8b4d9797e1a08adc68415d1f8a61dea0b3aad884dd9ebf3543d5e1761a0c65802e67dec9aa00166e3d27f6581756f37257a3ac3082d1
SSDEEP 6144:lzN72vG2VrrHhoKS9/NSEAt9xsv7c41FW3HuDw1yC7F3:lkrrHhoK1FsTc410XusRx
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

217088

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WriteFile CreateFileW GetLastError CloseHandle CreateProcessW IsDebuggerPresent HeapSize GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetStartupInfoW GetModuleHandleW RtlUnwind RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree GetFileType CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage WriteConsoleW

shell32

SHGetFolderPathW

wininet

InternetOpenUrlA InternetOpenW InternetCloseHandle InternetReadFile

Name

.text

Size

141KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.text

Size

102KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

user.exe

kernel32

shell32

wininet

generic