file[.]exe | Triage™

General

Target
file.exe
Size 1.8MB
Sample241031-lw8krawdkf
SHA256 a19257d178d7f240c830b29e8bb55d9b6320dc1b56795e4fa90267419ed4070c
MD5 fd89c359ab4ac38da6cf7fe6dabdb457
SHA1 9c2a99beb692849ba3eb11d114334636df04f5ff
SHA512 27e63d09f31a33bbaeae48bb64c3802623a20352657e218b04c0378e88a1b090629c85a09cce6f56a417abb12c1dc6f5cc8b7456c9c58bf05ffd33a0e2eb5904
SSDEEP 24576:mH7eZ9qb3yhIK20e6yaftS/h0lhSMXlEnuxl6XjxIp/jZKUSd5gnU+ZpdF:S7eZu3y+wsuxgXjCtj5Sd5Grn
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 1.8MB

file.exe

IMPHASH b747ef4e0e7f8f3178c8471e453f4b5f
SHA256 a19257d178d7f240c830b29e8bb55d9b6320dc1b56795e4fa90267419ed4070c
MD5 fd89c359ab4ac38da6cf7fe6dabdb457
SHA1 9c2a99beb692849ba3eb11d114334636df04f5ff
SHA512 27e63d09f31a33bbaeae48bb64c3802623a20352657e218b04c0378e88a1b090629c85a09cce6f56a417abb12c1dc6f5cc8b7456c9c58bf05ffd33a0e2eb5904
SSDEEP 24576:mH7eZ9qb3yhIK20e6yaftS/h0lhSMXlEnuxl6XjxIp/jZKUSd5gnU+ZpdF:S7eZu3y+wsuxgXjCtj5Sd5Grn
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

226772

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

VirtualFree VirtualAlloc GetModuleHandleW LoadLibraryA ReadFile WriteFile CreateFileW UnmapViewOfFile CloseHandle CreateFileMappingW MapViewOfFile GetProcAddress GetCurrentProcess VirtualQuery RemoveVectoredExceptionHandler MultiByteToWideChar LoadLibraryW AddVectoredExceptionHandler WideCharToMultiByte FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetLastError SetLastError RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection DeleteCriticalSection HeapAlloc HeapFree GetCurrentThreadId GetStdHandle GetFileType GetStartupInfoW RaiseException GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionAndSpinCount GetSystemTimeAsFileTime FreeLibrary LoadLibraryExW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW HeapReAlloc HeapSize GetProcessHeap IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW ExitProcess GetModuleHandleExW SetStdHandle GetModuleFileNameW WriteConsoleW QueryPerformanceCounter GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlUnwind RtlPcToFileHeader EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree VirtualProtect VirtualQueryEx ReadProcessMemory WriteProcessMemory GetSystemInfo InitializeCriticalSection FindClose FindFirstFileExW FindNextFileW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeCriticalSectionEx DecodePointer LCMapStringEx CreateEventW

ntdll

NtRaiseHardError NtMapViewOfSection RtlCreateUnicodeString NtOpenSection NtQueryObject NtContinue NtUnmapViewOfSection RtlFreeHeap NtClose RtlAdjustPrivilege RtlAllocateHeap NtGetContextThread RtlCompareUnicodeString NtCreateSection

Name

.text

Size

537KB

Virtual Size

536KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

kernel32

ntdll

generic