file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 447KB
Sample240921-17cd1sxbla
SHA256 1996a7a79e6ce7906689e931fcd89febd9be1f6d4abe18a9116a5c3425fd5891
MD5 b1c49ee1e138ebf940dce1c2b68d8215
SHA1 bd909c8d20843a4f52574445cec75c2256cfc888
SHA512 72dbc9c9348619fe4bb9079b70e3a5f11cabc7d1a5d3c725b7b7f8b15e57d6c2d94fe8778db91274a459f6419ba3f64e90004497e0afccf0d11a3332bdbb105e
SSDEEP 6144:DB8WWaVxc1L7VO0bNWBe+J7w0wfll5FXCnFk:DKFaVe1PVxc8+59QFSC
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 447KB

file.exe

IMPHASH 2f3fb52e2448b38ca202de4ef9ca1d86
SHA256 1996a7a79e6ce7906689e931fcd89febd9be1f6d4abe18a9116a5c3425fd5891
MD5 b1c49ee1e138ebf940dce1c2b68d8215
SHA1 bd909c8d20843a4f52574445cec75c2256cfc888
SHA512 72dbc9c9348619fe4bb9079b70e3a5f11cabc7d1a5d3c725b7b7f8b15e57d6c2d94fe8778db91274a459f6419ba3f64e90004497e0afccf0d11a3332bdbb105e
SSDEEP 6144:DB8WWaVxc1L7VO0bNWBe+J7w0wfll5FXCnFk:DKFaVe1PVxc8+59QFSC
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27181

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCommState InterlockedDecrement GetCurrentProcess InterlockedCompareExchange CreateHardLinkA GetModuleHandleW CreateNamedPipeW EnumCalendarInfoExW GetNumberFormatA TlsSetValue LoadLibraryW GetLocaleInfoW GetCalendarInfoA CreateEventA SetVolumeMountPointA GetFileAttributesA GetTimeFormatW GetModuleFileNameW CreateActCtxA FindNextVolumeMountPointW GetTempPathW GetShortPathNameA CreateJobObjectA VerifyVersionInfoW InterlockedExchange GlobalUnfix GetLogicalDriveStringsA GetLastError GetCurrentDirectoryW GetProcAddress GetLongPathNameA PeekConsoleInputW EnumSystemCodePagesW GetConsoleDisplayMode InterlockedIncrement LoadModule GetProcessVersion SetThreadPriorityBoost LoadLibraryA InterlockedExchangeAdd CreateFileMappingA LocalAlloc GetFileType FoldStringW SetEnvironmentVariableA EnumDateFormatsA GetProcessShutdownParameters LoadLibraryExA GetFileTime WaitForDebugEvent OpenEventW SetFileShortNameA GetVersionExA GetDiskFreeSpaceExW GetWindowsDirectoryW LocalFree LCMapStringW CommConfigDialogW CloseHandle GetStringTypeW MultiByteToWideChar CreateFileW WriteConsoleW RaiseException GetConsoleAliasExesLengthA SetEndOfFile GetConsoleAliasExesA EnumCalendarInfoA GlobalMemoryStatus SetComputerNameA SetDefaultCommConfigA HeapSize FlushFileBuffers SetStdHandle IsValidCodePage HeapAlloc HeapReAlloc ExitProcess DecodePointer GetCommandLineW HeapSetInformation GetStartupInfoW IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount DeleteCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess WriteFile HeapCreate HeapFree SetFilePointer TlsAlloc TlsGetValue TlsFree SetLastError GetCurrentThreadId FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime Sleep WideCharToMultiByte GetConsoleCP GetConsoleMode RtlUnwind GetCPInfo GetACP GetOEMCP

user32

SetCaretPos GetMenuStringA LoadMenuA InsertMenuItemW GetMenu DrawStateA GetWindowLongW GetSysColor CharUpperA

gdi32

GetBkMode GetCharWidthFloatA CreateDCA GetCharWidth32W GetTextCharset GetCharWidthI

winhttp

WinHttpConnect

msimg32

GradientFill