bEsOrli29K[.]exe | Triage™

General

Target
bEsOrli29K.exe
Size 213KB
Sample240902-sblc2ssgjj
SHA256 02c6f9163a5d988cee3ab12c11e03b18329c26d6b4863004f943133654693e97
MD5 a3247152e18ba6e88311f082a86515d3
SHA1 80da2f14bb17f2d3ff1df6faf25622ebb8cf00c8
SHA512 b09fc49d7126b37c37f499be522c4b57e7538d2f64600bd789c93d90a315a023f0fbed9466c6069a38bb8c80bc9a6b250fcaec03b59ecfb3a40754c235c3e6d8
SSDEEP 3072:AOFL8HN3BB33u/iMUk6efofpWqX2hnesi5kb:tLqN3Bt36iM/ofpKhn9
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bEsOrli29K.exe

File Explorer

bEsOrli29K.exe

.exe 213KB

bEsOrli29K.exe

IMPHASH 48018783cf28f3141db6304599edb5a2
SHA256 02c6f9163a5d988cee3ab12c11e03b18329c26d6b4863004f943133654693e97
MD5 a3247152e18ba6e88311f082a86515d3
SHA1 80da2f14bb17f2d3ff1df6faf25622ebb8cf00c8
SHA512 b09fc49d7126b37c37f499be522c4b57e7538d2f64600bd789c93d90a315a023f0fbed9466c6069a38bb8c80bc9a6b250fcaec03b59ecfb3a40754c235c3e6d8
SSDEEP 3072:AOFL8HN3BB33u/iMUk6efofpWqX2hnesi5kb:tLqN3Bt36iM/ofpKhn9
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

5961

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetComputerNameA GetFullPathNameA GetNumaProcessorNode GetProcessIoCounters OpenJobObjectA UnlockFile GetTimeFormatA GetModuleHandleW GetTickCount GetDateFormatA GetSystemTimes GlobalAlloc LoadLibraryW FormatMessageW InitAtomTable HeapCreate FlushInstructionCache GetProcAddress GetNumaHighestNodeNumber GetAtomNameA LoadLibraryA InterlockedExchangeAdd SetCalendarInfoW VirtualLock HeapLock GetCommMask GetCurrentConsoleFont SetCommMask FoldStringA lstrcatW FreeEnvironmentStringsW VirtualProtect EnumDateFormatsW SetFileShortNameA DebugBreak GetModuleHandleA GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc EnterCriticalSection LeaveCriticalSection ReadFile SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId GetLastError InterlockedDecrement Sleep HeapSize ExitProcess WriteFile GetModuleFileNameA GetModuleFileNameW GetEnvironmentStringsW GetCommandLineW VirtualFree HeapFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage VirtualAlloc HeapReAlloc RtlUnwind MultiByteToWideChar InitializeCriticalSectionAndSpinCount SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA FlushFileBuffers CreateFileA CloseHandle RaiseException

user32

InflateRect GetActiveWindow LoadIconA

Sharing