file[.]exe | Triage™

General

Target
file.exe
Size 203KB
Sample251019-er8lmayldp
SHA256 d3405ace4b88d4db1c4e3eed861aef9ec5269b97383b1f638df3b6ccf5b43eeb
MD5 09aeaf3bcbb1d962fd86cc6d3ffb7c1c
SHA1 6ecac94e64735abd81c443583889224f6ae691f6
SHA512 634aef1719aae58ed764e4d3abd4c478558641a8541580acbb4a7d6ccde0f38044d942ae60314c0ae307cbf1c583c89e066a120bf35c2164e03811c739593259
SSDEEP 3072:phu8OLzpe+uYPirDdpzTYN6jFlA4+49THfw+GTcL+Rkm8EvAB:phu8OgI6rDPzTNDZ+O0q+RtA
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 203KB

file.exe

IMPHASH 8118829b8ffa6d0681e0692bc01a578e
SHA256 d3405ace4b88d4db1c4e3eed861aef9ec5269b97383b1f638df3b6ccf5b43eeb
MD5 09aeaf3bcbb1d962fd86cc6d3ffb7c1c
SHA1 6ecac94e64735abd81c443583889224f6ae691f6
SHA512 634aef1719aae58ed764e4d3abd4c478558641a8541580acbb4a7d6ccde0f38044d942ae60314c0ae307cbf1c583c89e066a120bf35c2164e03811c739593259
SSDEEP 3072:phu8OLzpe+uYPirDdpzTYN6jFlA4+49THfw+GTcL+Rkm8EvAB:phu8OgI6rDPzTNDZ+O0q+RtA
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

62896

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

wsprintfA

shell32

SHGetFolderPathW ShellExecuteExW

kernel32

SetFilePointerEx GetConsoleMode SetStdHandle LoadLibraryW OutputDebugStringW WriteConsoleW FlushFileBuffers GetConsoleCP HeapFree LoadLibraryExW EnumSystemLocalesEx GlobalLock GetCurrentThread GlobalAlloc Sleep SetThreadPriority GlobalUnlock GetProcAddress GlobalFree LoadLibraryA WriteFile CreateFileW lstrcatW CloseHandle WaitForSingleObject GetWindowsDirectoryA GetVolumeInformationA CopyFileW GetExitCodeProcess GetModuleFileNameW lstrlenW GetLastError CreateMutexA ReleaseMutex SetFileAttributesW lstrcpyW CreateThread EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection WideCharToMultiByte GetLocaleInfoEx MultiByteToWideChar GetStringTypeW GetCommandLineW HeapReAlloc IsDebuggerPresent IsProcessorFeaturePresent GetSystemTimeAsFileTime RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx HeapAlloc InitializeCriticalSectionAndSpinCount GetCPInfo SetLastError GetCurrentThreadId ExitProcess GetModuleHandleExW GetStdHandle GetProcessHeap GetFileType InitOnceExecuteOnce GetStartupInfoW QueryPerformanceCounter GetTickCount64 GetEnvironmentStringsW FreeEnvironmentStringsW RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter FlsAlloc FlsGetValue FlsSetValue FlsFree GetCurrentProcess TerminateProcess GetModuleHandleW HeapSize GetACP IsValidCodePage GetOEMCP CompareStringEx GetUserDefaultLocaleName LCMapStringEx IsValidLocaleName

Sharing