file[.]exe | Triage™

General

Target
file.exe
Size 290KB
Sample251204-xsqrbasmd1
SHA256 487b6acddac1739cc3a60cf049c4c33fc6b90df631f71b414775e3c83661afec
MD5 8d49293d20fba985a8db9e27e0519b00
SHA1 921f90b9e96112d457efc92325afcdd638d72274
SHA512 79518f1e1d5abdf5866f0fd0fa4c5fed822842e1a7e7c2e7bafd65651f880110eff0a93bc6e5abfe12cd757a25497b192dc5683b1e766dd32f84fd6062903b34
SSDEEP 3072:ufRbXxsn6slR57cZ6EhE4IQNv8kAeI2yEe28Plq9njUIg9P8W/mrakO+OlhCxFUo:ufRbGY6EDNNAuHe28Pl2ncxlUvR2O
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 290KB

file.exe

IMPHASH 53e19d5243b4f25d48df742c8d94ac9c
SHA256 487b6acddac1739cc3a60cf049c4c33fc6b90df631f71b414775e3c83661afec
MD5 8d49293d20fba985a8db9e27e0519b00
SHA1 921f90b9e96112d457efc92325afcdd638d72274
SHA512 79518f1e1d5abdf5866f0fd0fa4c5fed822842e1a7e7c2e7bafd65651f880110eff0a93bc6e5abfe12cd757a25497b192dc5683b1e766dd32f84fd6062903b34
SSDEEP 3072:ufRbXxsn6slR57cZ6EhE4IQNv8kAeI2yEe28Plq9njUIg9P8W/mrakO+OlhCxFUo:ufRbGY6EDNNAuHe28Pl2ncxlUvR2O
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

61492

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

ShellExecuteExW SHGetKnownFolderPath ord680 ShellExecuteA

ole32

CoInitialize CoUninitialize CoTaskMemFree

urlmon

URLDownloadToFileW

kernel32

GetCurrentProcessId WriteConsoleW HeapSize GetProcessHeap SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP CloseHandle GetLastError Sleep CreateProcessA GetSystemDirectoryA GetModuleFileNameW WideCharToMultiByte LocalFree FormatMessageA GetLocaleInfoEx QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW CreateFile2 AreFileApisANSI GetModuleHandleW GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlUnwind GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetACP RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW GetConsoleCP IsProcessorFeaturePresent GetStdHandle WriteFile GetCurrentProcess ExitProcess TerminateProcess RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree GetFileType VirtualProtect LoadLibraryExW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW CreateFileW GetConsoleMode SetConsoleMode GetNumberOfConsoleInputEvents ReadConsoleInputW PeekConsoleInputA ReadConsoleW FlushFileBuffers GetConsoleOutputCP ReadFile GetFileSizeEx SetFilePointerEx HeapReAlloc IsValidCodePage

Name

.text

Size

188KB

Virtual Size

188KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

shell32

ole32

urlmon

kernel32

generic