file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 313KB
Sample240710-e1z1vaycpg
SHA256 0fa34507e4989e8a96cea715d3418f343bc35cbb256d63da1a87ea82de59c350
MD5 901de7cb6103de0abf3d549ce4e89abf
SHA1 b1475c244d289967a7274770fc0986105ffccc21
SHA512 526bf8b79645f4abe98d9e7c9c1fe26aa1a1e69aef5e1567bf081cd0920572de7115232cfd456042cb165b44e86608d1a6959a6f7f5dc2c92cd04f8f6a3ddc0e
SSDEEP 3072:i/HcVeYlfwazMo4z8sP2s2swvoLhkHiVpxf7HV1Umwp8JdM:ocHJkasRhHxHV1UJp8TM
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 313KB

file.exe

IMPHASH 5d2c2864321344c11f1d49b7f3118944
SHA256 0fa34507e4989e8a96cea715d3418f343bc35cbb256d63da1a87ea82de59c350
MD5 901de7cb6103de0abf3d549ce4e89abf
SHA1 b1475c244d289967a7274770fc0986105ffccc21
SHA512 526bf8b79645f4abe98d9e7c9c1fe26aa1a1e69aef5e1567bf081cd0920572de7115232cfd456042cb165b44e86608d1a6959a6f7f5dc2c92cd04f8f6a3ddc0e
SSDEEP 3072:i/HcVeYlfwazMo4z8sP2s2swvoLhkHiVpxf7HV1Umwp8JdM:ocHJkasRhHxHV1UJp8TM
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8503

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEndOfFile FindResourceW LocalCompact WriteConsoleInputA GetComputerNameW GetWindowsDirectoryA GetDateFormatA SetProcessPriorityBoost GlobalFindAtomA LoadLibraryW FreeConsole CreateEventA GetModuleFileNameW CreateFileW GetACP IsBadStringPtrA ReplaceFileA CreateDirectoryA GetLastError CommConfigDialogA GetProcAddress GlobalFree LocalAlloc EnumResourceTypesW GetModuleHandleA CancelIo OpenFileMappingW GetWindowsDirectoryW SetFileAttributesW RaiseException HeapReAlloc HeapAlloc GetStringTypeW MultiByteToWideChar SetLastError RemoveVectoredExceptionHandler LCMapStringW HeapSize RtlUnwind Sleep IsValidCodePage HeapFree GetCommandLineA HeapSetInformation GetStartupInfoW IsProcessorFeaturePresent HeapCreate SetUnhandledExceptionFilter GetModuleHandleW ExitProcess DecodePointer WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime UnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess LeaveCriticalSection EnterCriticalSection GetCPInfo GetOEMCP

user32

GetKeyboardLayoutNameA SetMessageExtraInfo GetCaretPos DdeCmpStringHandles GetClassInfoW InsertMenuItemW CharUpperBuffA

advapi32

GetLengthSid

ole32

CoSuspendClassObjects CoUnmarshalHresult

winhttp

WinHttpOpen