file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 2.7MB
Sample240513-vk87kseh21
SHA256 ca58a17fe665c5997d673e7e5317d2a70dc2225ced1dbeea010888874ae48a81
MD5 d18dbc8c3596af59d661a2d0437bb173
SHA1 0a88bb498001120fc5ae83764c5339f06ae70bac
SHA512 25c2563ec9bf5fbd9f8c3a0606015ba93f4cfd8a8ea9dae72b34fc43c57cb024c3fb97b6bf82b6a59d79b092c014c4c47ca202126755a96880e7476cc91e5e76
SSDEEP 24576:IRoBHi3buy4toE1jC6Ayo2xhWLbSPlqRvc68XzRVGvWB5VA0UC1dUUKj/yZ8j3gV:KoKmo4jC6TovwRUC1doj/ngV
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

file.exe

.exe 2.7MB

file.exe

IMPHASH f6df573862725a7261d77e9eebaebd3a
SHA256 ca58a17fe665c5997d673e7e5317d2a70dc2225ced1dbeea010888874ae48a81
MD5 d18dbc8c3596af59d661a2d0437bb173
SHA1 0a88bb498001120fc5ae83764c5339f06ae70bac
SHA512 25c2563ec9bf5fbd9f8c3a0606015ba93f4cfd8a8ea9dae72b34fc43c57cb024c3fb97b6bf82b6a59d79b092c014c4c47ca202126755a96880e7476cc91e5e76
SSDEEP 24576:IRoBHi3buy4toE1jC6Ayo2xhWLbSPlqRvc68XzRVGvWB5VA0UC1dUUKj/yZ8j3gV:KoKmo4jC6TovwRUC1doj/ngV
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

PE Signature issue

Digest

83:3a:19:1c:d9:4c:71:28:2c:7b:e6:d0:8d:15:a3:3a:d8:1a:60:c3:59:f3:3f:b3:3a:f4:43:a1:45:74:c7:87

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Code Signing PCA 2011,OU=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 12, 2024

Minor OS version

Major OS version

Entry point

432572

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW RegSetValueExA OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges GetTokenInformation DuplicateTokenEx OpenThreadToken RevertToSelf ImpersonateLoggedOnUser CheckTokenMembership EventWrite EventRegister EventEnabled

bcrypt

BCryptGenerateSymmetricKey BCryptGenRandom BCryptOpenAlgorithmProvider BCryptDestroyKey BCryptCloseAlgorithmProvider

kernel32

TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer CloseThreadpoolIo MultiByteToWideChar GetStdHandle TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToSystemTime GetSystemTime GetCalendarInfoEx CompareStringOrdinal CompareStringEx FindNLSStringEx GetLocaleInfoEx ResolveLocaleName GetUserPreferredUILanguages FindStringOrdinal GetTickCount64 GetCurrentProcess GetCurrentThread WaitForSingleObject Sleep CreateThreadpoolWork CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CloseThreadpoolWait DeleteCriticalSection LocalFree EnterCriticalSection SleepConditionVariableCS LeaveCriticalSection WakeConditionVariable QueryPerformanceCounter InitializeCriticalSection InitializeConditionVariable WaitForMultipleObjectsEx GetLastError QueryPerformanceFrequency SetLastError GetFullPathNameW GetLongPathNameW WideCharToMultiByte LocalAlloc GetConsoleOutputCP GetProcAddress RaiseFailFastException CreateThreadpoolIo StartThreadpoolIo CancelThreadpoolIo LocaleNameToLCID LCMapStringEx EnumTimeFormatsEx EnumCalendarInfoExEx CopyFileExW CreateDirectoryW CreateFileW DeleteFileW DeleteVolumeMountPointW CreateSymbolicLinkW DeviceIoControl ExpandEnvironmentStringsW FindNextFileW FindClose FindFirstFileExW FlushFileBuffers FreeLibrary GetCurrentDirectoryW GetFileAttributesExW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFinalPathNameByHandleW GetLogicalDrives GetModuleFileNameW GetOverlappedResult GetSystemDirectoryW GetVolumeInformationW LoadLibraryExW MoveFileExW ReadFile RemoveDirectoryW ReplaceFileW SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetThreadErrorMode GetDynamicTimeZoneInformation GetTimeZoneInformation WriteFile GetCurrentProcessorNumberEx CloseHandle SetEvent CreateEventExW GetEnvironmentVariableW FormatMessageW CreateThread ResumeThread DuplicateHandle GetThreadPriority SetThreadPriority GetCPInfoExW GetConsoleMode WriteConsoleW GetConsoleWindow LoadLibraryA GetModuleHandleA FreeConsole AllocConsole VirtualAllocEx GetExitCodeProcess CreateProcessW TerminateProcess OpenProcess K32EnumProcesses GetProcessId QueryFullProcessImageNameW CreatePipe GetConsoleCP FlushProcessWriteBuffers GetCurrentThreadId WaitForSingleObjectEx VirtualQuery RtlRestoreContext AddVectoredExceptionHandler FlsAlloc FlsGetValue FlsSetValue CreateEventW SwitchToThread SuspendThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree QueryInformationJobObject GetModuleHandleW GetModuleHandleExW GetProcessAffinityMask InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask InitializeCriticalSectionEx GetSystemTimeAsFileTime ResetEvent DebugBreak SleepEx GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo RaiseException RtlPcToFileHeader RtlUnwindEx IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead GetCurrentProcessId

ole32

CoGetApartmentType CoTaskMemAlloc CoUninitialize CoTaskMemFree CoCreateGuid CoWaitForMultipleHandles CoInitializeEx

user32

LoadStringW

api-ms-win-crt-math-l1-1-0

__setusermatherr sin modf tan ceil cos floor pow

api-ms-win-crt-heap-l1-1-0

calloc malloc _callnewh _set_new_mode free

api-ms-win-crt-string-l1-1-0

strncpy_s _stricmp strcpy_s _wcsicmp strcmp wcsncmp

api-ms-win-crt-runtime-l1-1-0

_exit __p___argc _initterm_e terminate _crt_atexit _register_onexit_function _initialize_onexit_table exit _initterm _get_initial_wide_environment abort __p___wargv _register_thread_local_exe_atexit_callback _c_exit _cexit _seh_filter_exe _set_app_type _initialize_wide_environment _configure_wide_argv

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s __p__commode __stdio_common_vfprintf __stdio_common_vsscanf _set_fmode __acrt_iob_func

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

461KB

Virtual Size

461KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

hydrated

Size

Virtual Size

553KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

926KB

Virtual Size

926KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

115KB

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.m4lw4r3

Size

11KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

PE Signature issue

advapi32

bcrypt

kernel32

ole32

user32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic