encode[.]exe | Triage™

General

Target
encode.exe
Size 294KB
Sample241009-ch8h6asclk
SHA256 4a767f6ae1d3df59e2e67c431549cf6307252442bd22900ac0f7c326c62de4de
MD5 b82be5191817f1dace2f469a8c179831
SHA1 a5ea5d5e89b9d16ccc0cb3c7e28d5be3405641c3
SHA512 8ab9ae147c48364c7e67271fce22bebf4c26886a83d71e096ba1b0808fed898bbd1dfceb263a0e7f9191929b98fb42d84d02c593f4b0c72b0e55cba42c0a01e9
SSDEEP 6144:wlf2r7Ktyp5/p6oqC1IZzoedqtlynOFuI:U2Hl5/p6oqgIZv+J7
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
encode.exe

File Explorer

encode.exe

.exe 294KB

encode.exe

IMPHASH 7341a42a351d70028e7e201b6a47612c
SHA256 4a767f6ae1d3df59e2e67c431549cf6307252442bd22900ac0f7c326c62de4de
MD5 b82be5191817f1dace2f469a8c179831
SHA1 a5ea5d5e89b9d16ccc0cb3c7e28d5be3405641c3
SHA512 8ab9ae147c48364c7e67271fce22bebf4c26886a83d71e096ba1b0808fed898bbd1dfceb263a0e7f9191929b98fb42d84d02c593f4b0c72b0e55cba42c0a01e9
SSDEEP 6144:wlf2r7Ktyp5/p6oqC1IZzoedqtlynOFuI:U2Hl5/p6oqgIZv+J7
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

62880

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

MultiByteToWideChar Sleep Process32NextW Process32FirstW CloseHandle K32GetModuleInformation GetProcAddress Module32NextW GetProcessHandleCount SetEndOfFile WriteConsoleW HeapSize CreateFileW SetStdHandle GetProcessHeap SetEnvironmentVariableW CreateToolhelp32Snapshot GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc ReadConsoleW ReadFile EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW OpenProcess K32EnumProcessModulesEx GetModuleHandleA GetProcessId GetCurrentProcess Beep GetStdHandle SetConsoleTitleA FreeEnvironmentStringsW SetConsoleTextAttribute QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId ReleaseSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer WideCharToMultiByte LCMapStringEx GetSystemTimeAsFileTime GetModuleHandleW WakeAllConditionVariable GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW WriteFile GetCommandLineA GetCommandLineW GetFileSizeEx SetFilePointerEx GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree RtlUnwind

user32

IsWindowVisible FindWindowExA GetWindowTextA GetMessageA DispatchMessageA DestroyWindow GetDC SetWindowPos FillRect ShowWindow GetAsyncKeyState GetWindowThreadProcessId GetWindowLongA GetForegroundWindow DefWindowProcA CreateWindowExA SetLayeredWindowAttributes TranslateMessage GetClientRect PostQuitMessage RegisterClassExA InvalidateRect BeginPaint EndPaint SetWindowLongA

gdi32

BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC GetStockObject DeleteDC CreatePen Rectangle DeleteObject

Name

.text

Size

198KB

Virtual Size

198KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

74KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

encode.exe

kernel32

user32

gdi32

generic