file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 349KB
Sample240404-de1vksch2v
SHA256 ac18848bccc7dc40bc9ad5ebfada86d41852f40009f420bd5b67e45c6768877d
MD5 7f3447492f215d7e070001ef8de53547
SHA1 ad407f3252f1dc0166dd806b3d31579dc43e55b7
SHA512 a2fd0ac21703095db23a4d0293316a8c9a6670dcbd20202bedef17a2241d75209899eb808aee8e88e2be4b31c79e3b0a4f5cd1eed3ad24503fc1dd89f4083cc6
SSDEEP 6144:KpPO+2IA6zsQ/JgbN2NImh6MCOljCcB6T:K9O+2IA6XC2NJhdCQ9q
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 349KB

file.exe

IMPHASH 5dd5d7719eaae9cf6383e765461f20f8
SHA256 ac18848bccc7dc40bc9ad5ebfada86d41852f40009f420bd5b67e45c6768877d
MD5 7f3447492f215d7e070001ef8de53547
SHA1 ad407f3252f1dc0166dd806b3d31579dc43e55b7
SHA512 a2fd0ac21703095db23a4d0293316a8c9a6670dcbd20202bedef17a2241d75209899eb808aee8e88e2be4b31c79e3b0a4f5cd1eed3ad24503fc1dd89f4083cc6
SSDEEP 6144:KpPO+2IA6zsQ/JgbN2NImh6MCOljCcB6T:K9O+2IA6XC2NJhdCQ9q
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16977

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\kewihu_wirecoyu-k.pdb

kernel32

GetNumaProcessorNode GetLocaleInfoA GlobalAddAtomA GetConsoleAliasA CompareFileTime MoveFileWithProgressA GetNumberFormatA ReadConsoleW GetVolumeInformationA GlobalFindAtomA LoadLibraryW TerminateThread ReadConsoleInputA GetConsoleAliasExesLengthW LeaveCriticalSection GetFileAttributesA WriteConsoleW GetModuleFileNameW GetConsoleOutputCP GetLastError SetThreadContext SetLastError GetProcAddress CopyFileA InterlockedExchangeAdd LocalAlloc FindFirstVolumeMountPointW QueryDosDeviceW VirtualLock GetModuleFileNameA VirtualProtect GetWindowsDirectoryW DeleteTimerQueueTimer GetTempPathA FindNextVolumeA SetEndOfFile CreateFileW GetStringTypeW RemoveVectoredExceptionHandler FindResourceA GetCurrentDirectoryW GetEnvironmentVariableW OutputDebugStringW FlushFileBuffers IsProcessorFeaturePresent EncodePointer DecodePointer ExitProcess GetModuleHandleExW AreFileApisANSI MultiByteToWideChar WideCharToMultiByte GetCommandLineW RaiseException RtlUnwind IsDebuggerPresent HeapAlloc HeapSize EnterCriticalSection HeapFree GetCurrentThreadId GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW CloseHandle UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW WriteFile LoadLibraryExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetProcessHeap QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW HeapReAlloc LCMapStringW GetConsoleCP GetConsoleMode SetFilePointerEx SetStdHandle ReadFile

user32

CharUpperBuffW CharUpperBuffA

gdi32

SetTextAlign

advapi32

RegisterEventSourceW

ole32

CoGetClassObject