file[.]exe | Triage™

resource
file.exe

file.exe

IMPHASH be41bf7b8cc010b614bd36bbca606973
SHA256 5afd5d949b10aa25737aeaf454ae3ad441311a50d0e8aace71ebec8ffe7118cf
MD5 888da0597b89d2a8dfc4c5d7dfb22dfd
SHA1 e9e2e864d4481edb3986bee9dc5c0ec1f7c75ffb
SHA512 2c74dccafa60be62479bde02ae76d591ad0399342ef46d3413fa63b6409bbcdc20031e8c97e9e92635587091300a2af7a9b9366f20ede78967d1090a10380db8
SSDEEP 24576:3iMy6W/0Pm3TL5HsTGdQw7qyxNif9wNknhIlVv22mtwbcPBjTP:SMLDyL5AZ429EkGl9maApTP
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

14467

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

516KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

114KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$TEMP/Coming

SHA256 03b54063e4c9fdf21c3a96d47c8656d362ea4a61ebfff32472fda18288f3f48d
MD5 15edcf792d0f0ca1cc7904d4ae62c923
SHA1 6045603a7383d84f2dfb918e3cf87c229ae20ebf
SHA512 f0e0eaba48f52e6edad1442e681a5eca25a2aabb73cda4836a6ed76236888d11bbf138fa00f6014879d670cf0c09e15f8eaac68538859d3715f0f33968449eba
SSDEEP 1536:AhRDujtHbj6LedM30dKmWR4/anObdA+dE86igbNN/zhxoT3guo7a0ZQ4h1r5:APDujYid6GnSOHE86VzLDoT09Nbr5
MD5 SHA1 SHA512 SSDEEP

$TEMP/Incentive

SHA256 5880c2ba93bf1e322b9b64dde80482fbf8241a774183065f0a66da77a24dc811
MD5 262a7cb0b04d21fec7dad22a56078105
SHA1 a42047d2bc9ec89301bf76833171fa06bc903ff4
SHA512 da9f2c2df9b289e6e3a387b69d88a3b663b2a2fa08ec64602f9d0d9b569c5502a7a60baf9c6a7ab249cdf1d7dafd8e219c422f131673f48b371da5cf71cc3465
SSDEEP 1536:Rr/BCKN5pidaBug/5ITTZC3HNw0c6xb5TiLjPxCjl2G9QHoqek8p/2yy/LLe7YcL:RrphNQav5C43HNn9b5Ti0UUeeOsoAxp
MD5 SHA1 SHA512 SSDEEP

$TEMP/Lamp

SHA256 be87ed58e140de6d091be21ead68d21777477b1e2790534e4bac514c02abb8f1
MD5 9dd14448873dff335f125cbe9dc393ae
SHA1 19ea969e8ba42886a1e063eddd65d0b7a4805f4c
SHA512 b34fd8652433eb72a744509f6b862f17a1258c623e6b02f6ffcd96373fa1d4541fb0a40600bba2fb30873742486bb269b115cb156659f8cb163ee55851f627c0
SSDEEP 192:nHAeOqAFDw09CV/2nPvj6DdMP3r1HI5jm:nHAHhww+/2nlP3r1Wm
MD5 SHA1 SHA512 SSDEEP

$TEMP/Moldova

SHA256 55d7b462d55257cb875ea3c06eec139087ae46527e93083fb2b307a33ab9fbb5
MD5 8b3c8ef2b1a323129bbcd2676bc53128
SHA1 7aeea7c18854fe6b76989cfd069ca6027b95645a
SHA512 0ffe8e704b280f5524222a37880c9eb28725ae9a46b8203f69b297b7a797291bc7444fecf9d23399bb6c7a80ebbf9081d788258e0aac782573de99d25da0e42a
SSDEEP 1536:GtUg086Nd9pOeE9eINvG+3ih8v2rqyvW1DjE:G49E9eINvG+Sh8v2q1DQ
MD5 SHA1 SHA512 SSDEEP

$TEMP/Pr

SHA256 420be9a63a7efea1a98052c744a16aa3f9af6af96ed40bbc29b7773d12ca16c1
MD5 56604e498dc7604384df38ca42860366
SHA1 16a3b078b05ac35b629bc5cd491d79ca777006a4
SHA512 a69ff6f4a9cf75bd62f17063b8888c3b32f4394d6208ee8901ed426d39a87e0bc99253b2f64c6bbbf18855309529c7cb42bf5b107c37c61b7ac0faa0968f881d
SSDEEP 12288:EV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:+xz1JMyyzlohMf1tN70aw8501
MD5 SHA1 SHA512 SSDEEP

$TEMP/Slave

SHA256 aee67a5dfd3cdfa602316c90fa746b21a5b6d8969e2236d8b1f5691af4c08e71
MD5 3f8d2748ccb68673d6d6cce431e3eccb
SHA1 dc1940e55213a9221ff3ad179d2cb1360205863e
SHA512 b286fec321d0981b9098275c8d9e7a099886f9889efa0707a00d973cffbda7ca08ff2008dcc5eb4a4d4a52a7d5ec2a857058c6339b690468dceb4c654b8602cb
SSDEEP 3072:uClaiT6fNIN18ChLxiCkung2vXA12/7ew+IcK2:uC4Py3pLECkug2N/7Pf2
MD5 SHA1 SHA512 SSDEEP

FindingsLawsuit/Pledge

SHA256 cfb8b8ae98588472553f431cad72c7bfed2038307e212f682b31fb9d60bdac45
MD5 d6437d94b27b4eb87c9151b06bf21601
SHA1 de1743c13e8de2312e941924421e9818984d5632
SHA512 f4f032d80ccf33aff2866848690fba08ad26630ce797de16ab386a0154238f57c514c44c6eed3042d4ca2614293f0e9f766068daaf891a8449b6817befdb0b2a
SSDEEP 192:970+nHc+UPyPTvYirwO2l+mbJuNKqa5JokfIep:94+1UPYAif2l3bsNKqkfIs
MD5 SHA1 SHA512 SSDEEP

FindingsLawsuit/Workshop

SHA256 36e78a13f4cfc76f6e7823d77cc84d90dfa7ae5ba56aa06c67c8c284a086c760
MD5 4f6a9d3477f08a3260e22e72a9f56ad1
SHA1 c073c52df221c2b8e6536c9659a543883595d6d6
SHA512 54c9e8594a04fac25a430f025e8a2d29631a73582d77ec541b3c573252f13fc9db54c077e6e89cdaf38bb482c1a5186dd0bdb95cad9f60cac0eb6e1621abc174
SSDEEP 1536:NRe9ZnKihw7Ex/DIFTouqQEYo7LLqYrVZyoxFKlqEB7whjkvRy11NjLRXHUNzxOI:y9//DI+uqQ07rJMbB8eI70XO0Ka
MD5 SHA1 SHA512 SSDEEP

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$TEMP/Coming

$TEMP/Incentive

$TEMP/Lamp

$TEMP/Moldova

$TEMP/Pr

$TEMP/Slave

FindingsLawsuit/Pledge

FindingsLawsuit/Workshop