file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 6.2MB
Sample240809-kd568ssdkh
SHA256 e9b46bc46e9bec0632d4e5311e5f79329ddba93416479bd9a2b9d57f13e7c898
MD5 dc074ad153c3355dcf323db77863b404
SHA1 ae3cd6238550adca3a2809a302d536dce90957fa
SHA512 b9b8820540576ae9b2bf372c5ec8c7a1ea8f6db4d4547668b77e67223a45cd608e998b1b74352419e6c2265e3c7552afb43ed7bff32b611c789960868474e195
SSDEEP 98304:ssRWMlKfFfdLLuA6quwceROHDNfjZa+SVlzVORsb98+L4Ow9fFrSfGk:ssRWMsWAe/eROH5A+S3Qs/Lm99rSe
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 6.2MB

file.exe

IMPHASH 5fd1ed0d65614ce22038aa299769018d
SHA256 e9b46bc46e9bec0632d4e5311e5f79329ddba93416479bd9a2b9d57f13e7c898
MD5 dc074ad153c3355dcf323db77863b404
SHA1 ae3cd6238550adca3a2809a302d536dce90957fa
SHA512 b9b8820540576ae9b2bf372c5ec8c7a1ea8f6db4d4547668b77e67223a45cd608e998b1b74352419e6c2265e3c7552afb43ed7bff32b611c789960868474e195
SSDEEP 98304:ssRWMlKfFfdLLuA6quwceROHDNfjZa+SVlzVORsb98+L4Ow9fFrSfGk:ssRWMsWAe/eROH5A+S3Qs/Lm99rSe
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4542749

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CopyFileA GetLastError GetFileAttributesA DeleteFileA CloseHandle CreateThread CreateProcessA CreateDirectoryA SetUnhandledExceptionFilter ReadFile WriteFile Sleep CreateFileW FindClose GetProcessHeap MultiByteToWideChar ReleaseMutex WaitForSingleObject CreateMutexA GetCurrentProcess GetModuleFileNameA SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW HeapReAlloc FlushFileBuffers SetEndOfFile SetStdHandle OutputDebugStringW GetTimeZoneInformation QueryPerformanceCounter WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress GetStringTypeW GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetCurrentThreadId InitializeSListHead TerminateProcess RtlUnwind RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle GetFileType GetModuleFileNameW GetModuleHandleExW WriteConsoleW SetFilePointerEx ExitProcess GetConsoleMode ReadConsoleW GetConsoleOutputCP HeapFree HeapAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW MoveFileExW GetFileSizeEx HeapSize VirtualQuery GetSystemTimeAsFileTime GetModuleHandleA CreateEventA GetModuleFileNameW LoadLibraryA TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree LocalAlloc LocalFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleHandleW LoadResource MultiByteToWideChar FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetCommandLineA RaiseException RtlUnwind HeapFree GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc LCMapStringA LCMapStringW SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter HeapReAlloc GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize WriteFile SetFilePointer GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount SetStdHandle LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

advapi32

GetUserNameA RegSetValueExA OpenProcessToken RegOpenKeyExA GetTokenInformation RegCloseKey

shell32

ShellExecuteA SHGetFolderPathA

ole32

CoCreateInstance CoUninitialize CoInitialize

ws2_32

send socket connect WSAStartup freeaddrinfo setsockopt WSAGetLastError getaddrinfo closesocket WSACleanup recv

wtsapi32

WTSSendMessageW

user32

GetProcessWindowStation GetUserObjectInformationW CharUpperBuffW MessageBoxW GetProcessWindowStation GetUserObjectInformationW

Name

.text

Size

Virtual Size

438KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmpJOA]

Size

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmpJOA]

Size

6.0MB

Virtual Size

6.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

168KB

Virtual Size

167KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

kernel32

advapi32

shell32

ole32

ws2_32

wtsapi32

user32

generic