f[.]exe | Triage™

General

Target
f.exe
Size 217KB
Sample250226-e2mf5symw2
SHA256 6b0936605c05ecd3e9658d3acfb9195893924778f3a41b2f74187de30a9af352
MD5 57932aab8116c9d1201cd56365d9b2c3
SHA1 3f249a42d82a1bdd5c15cb3c3b5c4cd968ec776c
SHA512 e0bdff8fe0b557a89da2b2aca5ca844d2d6855537b950ce5a3bf46a7548fc4030f9239892a87086325cf1f9a37f4e14c939f144b6302fd3426da543515edefd9
SSDEEP 3072:6eOjLpXVvSmdws9/WIdGTYoHoQiZ3zn/jmHd7cxatBgGgS/lPYxAxAj:AL5wmdeIze6zn/gFVg8FY6xA
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f.exe

File Explorer

f.exe

.exe 217KB

f.exe

IMPHASH be3932e3a098cfda071ebaa81fe7e38a
SHA256 6b0936605c05ecd3e9658d3acfb9195893924778f3a41b2f74187de30a9af352
MD5 57932aab8116c9d1201cd56365d9b2c3
SHA1 3f249a42d82a1bdd5c15cb3c3b5c4cd968ec776c
SHA512 e0bdff8fe0b557a89da2b2aca5ca844d2d6855537b950ce5a3bf46a7548fc4030f9239892a87086325cf1f9a37f4e14c939f144b6302fd3426da543515edefd9
SSDEEP 3072:6eOjLpXVvSmdws9/WIdGTYoHoQiZ3zn/jmHd7cxatBgGgS/lPYxAxAj:AL5wmdeIze6zn/gFVg8FY6xA
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

8328

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\juwihafih.pdb

kernel32

GetDefaultCommConfigW WriteConsoleOutputW HeapAlloc EndUpdateResourceW InterlockedIncrement GetCurrentProcess SetEnvironmentVariableW GetEnvironmentStringsW EnumCalendarInfoExW GetConsoleAliasesLengthA GetConsoleTitleA WriteFile GetUserDefaultLangID GetEnvironmentStrings GlobalAlloc SetVolumeMountPointA GetSystemWindowsDirectoryA lstrcpynW VerifyVersionInfoA HeapQueryInformation lstrlenA LCMapStringA GetCPInfoExW ChangeTimerQueueTimer GetProcAddress GetComputerNameExW CreateTimerQueueTimer FreeUserPhysicalPages EnterCriticalSection VerLanguageNameW GetLocalTime LoadLibraryA GetCurrentConsoleFont WaitForMultipleObjects GetOEMCP VirtualProtect PeekConsoleInputA FindFirstVolumeA GetVersionExA ReadConsoleInputW GetVersion AddConsoleAliasA CreateThread CreateFileA GetModuleFileNameW GetCommandLineW SetStdHandle WriteConsoleW WideCharToMultiByte InterlockedDecrement InterlockedExchange MultiByteToWideChar Sleep InitializeCriticalSection DeleteCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter GetLastError HeapFree TerminateProcess IsDebuggerPresent GetModuleHandleW ExitProcess GetStartupInfoW GetCPInfo RtlUnwind LCMapStringW GetStringTypeW GetStdHandle GetModuleFileNameA HeapCreate VirtualFree VirtualAlloc HeapReAlloc TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetStringTypeA HeapSize GetACP IsValidCodePage GetLocaleInfoA GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer CloseHandle WriteConsoleA GetConsoleOutputCP

user32

ClientToScreen RealGetWindowClassA

Sharing