file[.]exe | Triage™

Resubmissions

11/04/2024, 09:38

240411-ll3lragg4510

11/04/2024, 09:38

11/04/2024, 09:38

11/04/2024, 09:38

11/04/2024, 09:37

09/04/2024, 03:24

09/04/2024, 03:23

16/01/2024, 16:35

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 234KB
Sample240411-ll3lragg45
SHA256 b4d9bc9471648ef8d072e524b4c6e3f5793e29b663bc85a9809912e7fad320c2
MD5 ed0c899ce676b4f803a842b58805b16e
SHA1 6de3ccba1d1cfa0a9825787ce860201367980b43
SHA512 fd997ec5291062aea0c473dbdfe412c150296fc7794b8b9a77d3097726e2a6abc2af87d9d9eb1c12b2cf7f3420eaab49a85b387e8fe103381e310d82969eedf9
SSDEEP 3072:MPh8al1TPcpuOmohvNAJIP1jkxKJoMazKzu2Zoib2LhYt2QeEN4I9jXO9ZJwVQk:Oh11EjhvNPhJo/ezTbrWESIxOTF
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 234KB

file.exe

IMPHASH 5e7da97b0a0bc087e4fd6b16e0bfd913
SHA256 b4d9bc9471648ef8d072e524b4c6e3f5793e29b663bc85a9809912e7fad320c2
MD5 ed0c899ce676b4f803a842b58805b16e
SHA1 6de3ccba1d1cfa0a9825787ce860201367980b43
SHA512 fd997ec5291062aea0c473dbdfe412c150296fc7794b8b9a77d3097726e2a6abc2af87d9d9eb1c12b2cf7f3420eaab49a85b387e8fe103381e310d82969eedf9
SSDEEP 3072:MPh8al1TPcpuOmohvNAJIP1jkxKJoMazKzu2Zoib2LhYt2QeEN4I9jXO9ZJwVQk:Oh11EjhvNPhJo/ezTbrWESIxOTF
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9551

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

HeapFree GetTimeFormatA FreeEnvironmentStringsA GetTickCount TlsSetValue LoadLibraryW GetAtomNameW GetModuleFileNameW CompareStringW IsBadStringPtrA SetConsoleTitleA GetConsoleOutputCP GetConsoleAliasesW InterlockedExchange WriteConsoleOutputCharacterA GetProcAddress GetTapeStatus VirtualAlloc OpenWaitableTimerA LoadLibraryA LocalAlloc SetCalendarInfoW WritePrivateProfileStringA LocalFree SetFileAttributesW EnumSystemLocalesA GetUserDefaultLCID GetStringTypeW MultiByteToWideChar GetConsoleAliasExesLengthA GetLocaleInfoA GetLastError GetEnvironmentVariableW EncodePointer DecodePointer GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc IsProcessorFeaturePresent HeapCreate HeapDestroy Sleep HeapSize GetModuleHandleW ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection TlsAlloc TlsGetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCurrentThread QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime HeapReAlloc LeaveCriticalSection FatalAppExitA EnterCriticalSection SetConsoleCtrlHandler FreeLibrary GetLocaleInfoW RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW IsValidLocale

user32

GetForegroundWindow GetKeyNameTextW GetMonitorInfoA

advapi32

EnumDependentServicesW OpenEventLogW AccessCheckByTypeResultList

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

kernel32

user32

advapi32

generic