1[.]exe | Triage™

General

Target
1.exe
Size 813KB
Sample240520-j29nwsbb34
SHA256 35fba4ae966fe12c1b9c5dfdcc5b69c2991a412a0f1e5774118e172dbd40ad6e
MD5 8a35b10f431e16c1a30d5c837df343e5
SHA1 8f52cbf4905d0e1fa88d603cb02785107f6c06b8
SHA512 992392f63e84921ad9aa1cd42a9fe4bd55b305825a54fd9036ae468dacc8e6b11bfcebd8bfea90c02a6d62ec4bc7f3bdebd528b48d33d2f3d3640b533d8ab468
SSDEEP 12288:XHboTxwbed/QIA8Em9D+7m5BXIz1xYCp6IEJ9eHyg6EtF9/wDfbGRS:38TFQBe9QzgC6PcBdT/wzkS
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

1.exe

.exe 813KB

1.exe

IMPHASH 4dc3fe6326749d7464f4c796c8662bb3
SHA256 35fba4ae966fe12c1b9c5dfdcc5b69c2991a412a0f1e5774118e172dbd40ad6e
MD5 8a35b10f431e16c1a30d5c837df343e5
SHA1 8f52cbf4905d0e1fa88d603cb02785107f6c06b8
SHA512 992392f63e84921ad9aa1cd42a9fe4bd55b305825a54fd9036ae468dacc8e6b11bfcebd8bfea90c02a6d62ec4bc7f3bdebd528b48d33d2f3d3640b533d8ab468
SSDEEP 12288:XHboTxwbed/QIA8Em9D+7m5BXIz1xYCp6IEJ9eHyg6EtF9/wDfbGRS:38TFQBe9QzgC6PcBdT/wzkS
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

PE Signature issue

Digest

62:6a:e0:3d:9a:37:c8:4b:ca:d0:54:2e:54:b7:ca:d5:04:ae:b4:73:e9:fb:24:e2:85:da:80:b4:02:14:aa:37

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Code Signing PCA 2011,OU=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 17, 2024

Minor OS version

0

Major OS version

6

Entry point

124668

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetTempPathA Sleep CreateProcessA AllocConsole FreeConsole EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW SetEndOfFile RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType CloseHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap CreateFileW HeapSize WriteConsoleW RtlUnwind

Name

.text

Size

236KB

Virtual Size

235KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

139KB

Virtual Size

144KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

656B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1.exe

PE Signature issue

kernel32

generic