file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 373KB
Sample240403-kd5wgaba8v
SHA256 989c01c194f457c9a81c1951b0c7c7db154d2ffdc7f5bf4f30885a35d8bf8452
MD5 131d04c8500891636007511b2526ec7a
SHA1 31854acf875be122166eca7d79bde203987f3b5d
SHA512 64f44e66ca08bc6dbfecd84aed3f7939e8aa1ed805f72f85eeb51e5d7175a32bce1f651add5940899bdf8ad3d1a9524770a848d0a0eb57882d04ecacef0e3a8a
SSDEEP 6144:+KwJ/ZLBQBH5/Gl93mkHMTJdWitzK66jDliMT:+KwJBBQzel9WkHMFdBhd6F3
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 373KB

file.exe

IMPHASH 9f32342526e2fecc9f0ec103717925af
SHA256 989c01c194f457c9a81c1951b0c7c7db154d2ffdc7f5bf4f30885a35d8bf8452
MD5 131d04c8500891636007511b2526ec7a
SHA1 31854acf875be122166eca7d79bde203987f3b5d
SHA512 64f44e66ca08bc6dbfecd84aed3f7939e8aa1ed805f72f85eeb51e5d7175a32bce1f651add5940899bdf8ad3d1a9524770a848d0a0eb57882d04ecacef0e3a8a
SSDEEP 6144:+KwJ/ZLBQBH5/Gl93mkHMTJdWitzK66jDliMT:+KwJBBQzel9WkHMFdBhd6F3
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15857

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\boruzudekeja_bodag\texabeju.pdb

kernel32

GetConsoleAliasExesLengthA FindResourceW CompareFileTime QueryDosDeviceA _lcreat MoveFileWithProgressA GetNumberFormatA ReadConsoleW GetConsoleCP GlobalFindAtomA LoadLibraryW TerminateThread ReadConsoleInputA CopyFileW LeaveCriticalSection GetFileAttributesA GetConsoleAliasW WriteConsoleW GetModuleFileNameW GetLocaleInfoA GetLastError GetCurrentDirectoryW ChangeTimerQueueTimer SetLastError GetProcAddress InterlockedExchangeAdd LocalAlloc VirtualLock FindFirstVolumeMountPointA VirtualProtect GetWindowsDirectoryW GlobalAddAtomW GetTempPathA FindNextVolumeA GetVolumeInformationW SetEndOfFile CreateFileW RemoveVectoredExceptionHandler SetThreadContext GetEnvironmentVariableA GetNumaNodeProcessorMask GetStringTypeW OutputDebugStringW FlushFileBuffers SetStdHandle IsProcessorFeaturePresent EncodePointer DecodePointer ExitProcess GetModuleHandleExW AreFileApisANSI MultiByteToWideChar WideCharToMultiByte GetCommandLineW RaiseException RtlUnwind IsDebuggerPresent HeapAlloc HeapSize EnterCriticalSection HeapFree GetCurrentThreadId GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW CloseHandle UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW WriteFile LoadLibraryExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetProcessHeap QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW HeapReAlloc LCMapStringW GetConsoleMode SetFilePointerEx ReadFile

user32

CharUpperBuffA

gdi32

SetTextColor

advapi32

RegisterEventSourceW

ole32

CoGetPSClsid

msimg32

AlphaBlend