file[.]exe | Triage™

General

Target
file.exe
Size 270KB
Sample240920-glaths1gmb
SHA256 a2b8d4f469a7b8c8900df12569de67f5c8cb68e68177d482ff7ccfe9d580101b
MD5 55cf0ba0a65d11eee638b11ba9e2f3a1
SHA1 a34d2eca33a11ee443675788174220984963be47
SHA512 474f6edd85755b256e23f1168f460516385f1adda62604e37bd95339c526ee81077854c6aaf171db0420173fd3eeb371070173f8036a106f3b28c5bf96fcfd67
SSDEEP 6144:tDN0YXMIebj1xc/2K1OIoZ8yruBSXMPoiHzWZVfPybyX86EsUY:t+/IebS2sOZZ8yruBSXMPohPyi8j
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 270KB

file.exe

IMPHASH 827297e739d4dc45bd5e6431a2540fd7
SHA256 a2b8d4f469a7b8c8900df12569de67f5c8cb68e68177d482ff7ccfe9d580101b
MD5 55cf0ba0a65d11eee638b11ba9e2f3a1
SHA1 a34d2eca33a11ee443675788174220984963be47
SHA512 474f6edd85755b256e23f1168f460516385f1adda62604e37bd95339c526ee81077854c6aaf171db0420173fd3eeb371070173f8036a106f3b28c5bf96fcfd67
SSDEEP 6144:tDN0YXMIebj1xc/2K1OIoZ8yruBSXMPoiHzWZVfPybyX86EsUY:t+/IebS2sOZZ8yruBSXMPohPyi8j
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

15614

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCommState InterlockedDecrement GetCurrentProcess SetEnvironmentVariableW InterlockedCompareExchange SetVolumeMountPointW GetModuleHandleW CreateNamedPipeW FindNextVolumeMountPointA GetNumberFormatA CreateActCtxW TlsSetValue LoadLibraryW GetLocaleInfoW GetCalendarInfoA GetFileAttributesW GetModuleFileNameW GetShortPathNameA CreateJobObjectA VerifyVersionInfoW InterlockedExchange GlobalUnfix GetLogicalDriveStringsA GetLastError SetLastError GetProcAddress PeekConsoleInputW EnumSystemCodePagesW GetConsoleDisplayMode SetComputerNameA LoadModule SetThreadPriorityBoost GetConsoleAliasExesLengthA GetFileType CreateFileMappingW CreateHardLinkW CreateEventW FoldStringW GetProcessShutdownParameters LoadLibraryExA VirtualProtect GetCurrentDirectoryA EnumDateFormatsW GetFileTime OpenEventW SetCalendarInfoA SetFileShortNameA GetVersionExA GetDiskFreeSpaceExW GetWindowsDirectoryW DebugBreak GetTempPathA EnumCalendarInfoExA LocalFree LCMapStringW CommConfigDialogW IsProcessorFeaturePresent GetStringTypeW MultiByteToWideChar WideCharToMultiByte IsValidCodePage SetEndOfFile GetConsoleAliasExesA EnumCalendarInfoA GlobalMemoryStatus LocalAlloc SetDefaultCommConfigA GetOEMCP GetACP HeapFree HeapAlloc EncodePointer DecodePointer HeapReAlloc GetCommandLineW HeapSetInformation GetStartupInfoW HeapCreate ExitProcess WriteFile GetStdHandle Sleep HeapSize SetUnhandledExceptionFilter FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount DeleteCriticalSection TlsAlloc TlsGetValue TlsFree InterlockedIncrement GetCurrentThreadId QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime UnhandledExceptionFilter IsDebuggerPresent TerminateProcess LeaveCriticalSection EnterCriticalSection RtlUnwind GetCPInfo

user32

CharUpperA SetCaretPos LoadMenuA GetMenuStringW GetWindowLongW InsertMenuItemW GetMenu DrawStateW

gdi32

GetCharWidthFloatA CreateDCA GetCharWidth32A GetTextMetricsA GetBkMode

ole32

CoUnmarshalHresult

Name

.text

Size

204KB

Virtual Size

204KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

32.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.yupehek

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bigo

Size

512B

Virtual Size

214B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.lud

Size

1024B

Virtual Size

923B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.welo

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

40KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

kernel32

user32

gdi32

ole32

generic