file[.]exe | Triage

Sharing

General

Target

file.exe
Size

25KB
MD5

031377e4e34dcd19917fac02ff6da79f
SHA1

0fcccffee83cbb77a87ca1b55abc8e18fb267afc
SHA256

d58061a43df6b63e97421904c066ed5ad4b87a3733c250e105e83bc7154d9414
SHA512

f682a314a74dad1269dc1d948dc0c4773eb08e76ab364c3d5a9893577395126e5a409fca18cab24378e95fa71b8d96e20ad22e644275daf3f997edf8592da5c4
SSDEEP

384:jduHBY6QtYnfd6unCuUe1v5NFWJKtEBHx5fyf9SdsPDhxWBtIBLAKhm38fARlQWy:jduH/v1v5NxffIdIfDBtfARl/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

Files

file.exe
.exe windows:5 windows x64 arch:x64

d379cbaf0643853afc3c79c366e49af2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetVolumeInformationW
GetWindowsDirectoryW
SetFileAttributesW
CreateDirectoryW
lstrcatW
DeleteFileW
GetModuleFileNameW
GetVersionExW
ReadFile
CloseHandle
HeapAlloc
GetProcessHeap
GetFileSize
CreateFileW
LoadLibraryA
HeapFree
GetProcAddress

advapi32

RegSetValueExW
RegOpenKeyExW

shell32

SHGetFolderPathW

Sections

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ