file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 220KB
Sample240704-en3k7stdmp
SHA256 9b5bb6664b66132e313e9f3e6bf35452008d2e47a91913918a633b348133b617
MD5 990159d65a7268e9f9da50e115e7fcec
SHA1 ce4ef81f35dae8b12628d6588534a4510c429776
SHA512 50e1c5ccdf2630abdc8896190cfdda54316a343e7ac245ae77490acefd13cd1634786099eb7b1e0cc4c4a676a0eac70c2126670638af79710f204e34b3c3d4f2
SSDEEP 3072:4mk5pwID0GBdET653rNnGLqTEjdL51iGaP4vADr2eeienD1OBfHl:4zGQ0GBdET6LnGLqTQLHIZieeieJOBf
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 220KB

file.exe

IMPHASH a41cb227b532719e916aace9338b6342
SHA256 9b5bb6664b66132e313e9f3e6bf35452008d2e47a91913918a633b348133b617
MD5 990159d65a7268e9f9da50e115e7fcec
SHA1 ce4ef81f35dae8b12628d6588534a4510c429776
SHA512 50e1c5ccdf2630abdc8896190cfdda54316a343e7ac245ae77490acefd13cd1634786099eb7b1e0cc4c4a676a0eac70c2126670638af79710f204e34b3c3d4f2
SSDEEP 3072:4mk5pwID0GBdET653rNnGLqTEjdL51iGaP4vADr2eeienD1OBfHl:4zGQ0GBdET6LnGLqTQLHIZieeieJOBf
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10200

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

IsBadStringPtrW GetConsoleAliasesLengthW CommConfigDialogA SetEndOfFile FindResourceW InterlockedDecrement CreateDirectoryW WriteConsoleInputA GetWindowsDirectoryA TlsSetValue GlobalFindAtomA LoadLibraryW ReplaceFileA GlobalUnlock SetLastError GetProcAddress SetFileAttributesA FindResourceA LoadLibraryA LocalAlloc AddVectoredExceptionHandler GlobalGetAtomNameW OpenJobObjectW EnumResourceTypesW GetOEMCP OpenFileMappingW TerminateJobObject SetStdHandle WriteConsoleW CloseHandle SetFilePointer FlushFileBuffers GetConsoleMode GetConsoleCP HeapReAlloc CreateFileA GetDiskFreeSpaceW GetDateFormatW RaiseException HeapSize MultiByteToWideChar GetModuleHandleW ExitProcess DecodePointer GetCommandLineA HeapSetInformation GetStartupInfoW IsProcessorFeaturePresent HeapAlloc EnterCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess GetCurrentProcess SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection GetLastError HeapFree GetCPInfo InterlockedIncrement GetACP IsValidCodePage TlsAlloc TlsGetValue TlsFree GetCurrentThreadId WriteFile GetModuleFileNameW GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime Sleep RtlUnwind LCMapStringW GetStringTypeW CreateFileW

user32

GetKeyboardLayoutNameA SetMessageExtraInfo GetCaretPos InsertMenuItemW GetClassInfoW CharUpperBuffW DdeKeepStringHandle

gdi32

GetTextMetricsA GetCharWidthW

ole32

CoSuspendClassObjects CoMarshalHresult

winhttp

WinHttpCheckPlatform WinHttpWriteData