file[.]exe | Triage™

General

Target
file.exe
Size 933KB
Sample240516-qthc1afd99
SHA256 1f2fe6b3f3ec22a8c06aef1130b657f16524bd56003b53e453cac58cec91bc16
MD5 b0705df3198332a987f4b56a91f04d95
SHA1 7e2e7efb46febc0fd7c836869fa14a266623c95a
SHA512 46ad8e1712004c11eb62b748b042b31763972883e687bf48ee3b35c70a9eb66eb7ba77f47b53a23150c1d17701c378100033caf611b8c3b31a917eab64f20591
SSDEEP 24576:79xNAyNCBPzGOQhAcFovhDYmy6MmpwTwWLmJtxeYiwSpOmR1/K:79TCpGOQhAcivhDYswTPCJtxeYUf1/K
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

file.exe

.exe 933KB

file.exe

IMPHASH 7dec55701c2e13edf19d56a39cee7be9
SHA256 1f2fe6b3f3ec22a8c06aef1130b657f16524bd56003b53e453cac58cec91bc16
MD5 b0705df3198332a987f4b56a91f04d95
SHA1 7e2e7efb46febc0fd7c836869fa14a266623c95a
SHA512 46ad8e1712004c11eb62b748b042b31763972883e687bf48ee3b35c70a9eb66eb7ba77f47b53a23150c1d17701c378100033caf611b8c3b31a917eab64f20591
SSDEEP 24576:79xNAyNCBPzGOQhAcFovhDYmy6MmpwTwWLmJtxeYiwSpOmR1/K:79TCpGOQhAcivhDYswTPCJtxeYUf1/K
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

5e:85:4d:84:ff:36:eb:ff:10:e2:d0:21:73:db:0a:2a:cb:8b:eb:29

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Valve,O=Valve,L=Bellevue,ST=WA,C=US

Chains

Jun 20, 2017

CN=Valve,O=Valve,L=Bellevue,ST=WA,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Valve,O=Valve,L=Bellevue,ST=WA,C=US

Serial Number

08:4c:af:4d:f4:99:14:1d:40:4b:71:99:aa:2c:21:31

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 25, 2015 - Oct 3, 2018

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Minor OS version

0

Major OS version

6

Entry point

171996

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\5fhc1v\output.pdb

gdi32

GetClipBox

user32

PostQuitMessage

kernel32

CreateFileW HeapSize VirtualAlloc WaitForSingleObject GetModuleHandleA FreeConsole CreateThread GetProcAddress MultiByteToWideChar FormatMessageA GetStringTypeW WideCharToMultiByte GetCurrentThreadId CloseHandle WaitForSingleObjectEx Sleep SwitchToThread GetExitCodeThread GetNativeSystemInfo EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LocalFree GetLocaleInfoEx LCMapStringEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW QueryPerformanceCounter QueryPerformanceFrequency SetFileInformationByHandle GetTempPathW InitOnceExecuteOnce CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime GetTickCount64 FreeLibraryWhenCallbackReturns CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetModuleHandleW GetFileInformationByHandleEx CreateSymbolicLinkW CompareStringEx GetCPInfo IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW GetProcessHeap RaiseException RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitThread ResumeThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess HeapAlloc HeapFree GetCurrentThread GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetConsoleCtrlHandler GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc GetTimeZoneInformation OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

PE Signature issue

gdi32

user32

kernel32

generic