file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 7.8MB
Sample251222-t563aawmdv
SHA256 8bbc251d2ac9f059e23e593e77a2394bf81da09b468ff00946a1b82f0ccb9370
MD5 98e0842c2c726e85093bdf9211edff58
SHA1 6c22d02ac4ce345c3e323231ed8a1eca0087f555
SHA512 be729c1b985256a51b9fb8bade15532b47433a038d7d49843f4e18eb0250864df3ea81cc7fac1229041c2f82e0d7dcaf2e01bdf2ff2d5ab623e7e57bb6d664c2
SSDEEP 196608:asoI9NbClf8BU5SuZhOWWmX0rGyC7htsol9K1cIXj6x2jG2jS:azAxC58C5vOPmErYRyDPu
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 7.8MB

file.exe

IMPHASH 67715e556e3a78ea78c756db800102a3
SHA256 8bbc251d2ac9f059e23e593e77a2394bf81da09b468ff00946a1b82f0ccb9370
MD5 98e0842c2c726e85093bdf9211edff58
SHA1 6c22d02ac4ce345c3e323231ed8a1eca0087f555
SHA512 be729c1b985256a51b9fb8bade15532b47433a038d7d49843f4e18eb0250864df3ea81cc7fac1229041c2f82e0d7dcaf2e01bdf2ff2d5ab623e7e57bb6d664c2
SSDEEP 196608:asoI9NbClf8BU5SuZhOWWmX0rGyC7htsol9K1cIXj6x2jG2jS:azAxC58C5vOPmErYRyDPu
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

157605

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\src\wix38\build\ship\x86\burn.pdb

advapi32

OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW InitiateSystemShutdownExW GetUserNameW RegCloseKey RegQueryValueExW RegDeleteValueW ConvertStringSecurityDescriptorToSecurityDescriptorW DecryptFileW CreateWellKnownSid InitializeAcl SetEntriesInAclW ChangeServiceConfigW CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceStatus CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW SetNamedSecurityInfoW CheckTokenMembership AllocateAndInitializeSid SetEntriesInAclA SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetSecurityDescriptorDacl InitializeSecurityDescriptor RegSetValueExW RegQueryInfoKeyW RegEnumValueW RegEnumKeyExW RegDeleteKeyW RegCreateKeyExW GetTokenInformation RegOpenKeyExW QueryServiceConfigW

user32

GetMessageW PeekMessageW PostMessageW SetWindowLongW PostQuitMessage DispatchMessageW DefWindowProcW RegisterClassW UnregisterClassW CreateWindowExW LoadCursorW MessageBoxW LoadBitmapW TranslateMessage GetWindowLongW IsWindow MsgWaitForMultipleObjects WaitForInputIdle PostThreadMessageW GetMonitorInfoW MonitorFromPoint IsDialogMessageW GetCursorPos

oleaut32

SysFreeString SysAllocString VariantInit VariantClear

gdi32

GetObjectW StretchBlt SelectObject DeleteObject CreateCompatibleDC DeleteDC

shell32

ShellExecuteExW SHGetFolderPathW CommandLineToArgvW

ole32

CoTaskMemFree CoInitializeSecurity CLSIDFromProgID CoCreateInstance StringFromGUID2 CoInitialize CoInitializeEx CoUninitialize

kernel32

GetVersionExW CompareStringW VerSetConditionMask FreeLibrary GetProcAddress EnterCriticalSection LeaveCriticalSection GetSystemTime lstrlenW GetModuleHandleExW GetSystemDirectoryW GetTempPathW GetWindowsDirectoryW GetSystemWow64DirectoryW GetComputerNameW VerifyVersionInfoW GetVolumePathNameW GetDateFormatW GetSystemDefaultLangID GetUserDefaultLangID GetStringTypeW ExpandEnvironmentStringsW GetFileAttributesW ReadFile SetFilePointerEx CreateFileW InterlockedExchange InterlockedCompareExchange LoadLibraryW lstrlenA RemoveDirectoryW CreateEventW OutputDebugStringW ProcessIdToSessionId OpenProcess GetProcessId WaitForSingleObject WriteFile ConnectNamedPipe SetNamedPipeHandleState CreateNamedPipeW CreateThread GetExitCodeThread FindClose SetFileAttributesW FindFirstFileW FindNextFileW GetModuleHandleW WaitForMultipleObjects InterlockedIncrement InterlockedDecrement DuplicateHandle CreateProcessW SetCurrentDirectoryW GetCurrentDirectoryW GetExitCodeProcess SetThreadExecutionState CopyFileExW ResetEvent SetEndOfFile SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime CreateFileA CompareStringA MapViewOfFile UnmapViewOfFile CreateMutexW CreateFileMappingW VirtualAlloc VirtualFree GetSystemTimeAsFileTime DeleteFileW GetThreadLocale TlsFree TlsSetValue TlsGetValue TlsAlloc CloseHandle Sleep ReleaseMutex DeleteCriticalSection InitializeCriticalSection GetLastError GetTimeZoneInformation GetCPInfo GetOEMCP GetACP IsValidCodePage HeapFree RaiseException HeapAlloc IsProcessorFeaturePresent IsDebuggerPresent TerminateProcess SystemTimeToTzSpecificLocalTime SystemTimeToFileTime MoveFileExW CopyFileW RtlUnwind WideCharToMultiByte GetConsoleCP GetConsoleMode GetCurrentThreadId GetCurrentProcess LocalFree HeapSetInformation LoadLibraryExW SetEvent HeapReAlloc HeapSize LCMapStringW SetStdHandle WriteConsoleW FlushFileBuffers SetFilePointer GetLocalTime FormatMessageW GetTempFileNameW CreateDirectoryW GetFullPathNameW GetModuleHandleA GlobalAlloc GetCurrentProcessId SetUnhandledExceptionFilter UnhandledExceptionFilter FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetStartupInfoW InitializeCriticalSectionAndSpinCount GetFileType GetProcessHeap GetModuleFileNameW GetStdHandle GetFileSizeEx MultiByteToWideChar ExitProcess DecodePointer GetCommandLineW SetLastError EncodePointer GlobalFree

cabinet

ord20 ord22 ord23

crypt32

CertGetCertificateContextProperty CryptHashPublicKeyInfo

msi

ord118 ord115 ord171 ord125 ord17 ord8 ord116 ord111 ord173 ord45 ord205 ord90 ord141 ord137 ord169 ord70 ord88 ord190 ord238

rpcrt4

UuidCreate

wininet

HttpQueryInfoW InternetOpenW InternetCloseHandle InternetConnectW InternetReadFile InternetSetOptionW HttpOpenRequestW HttpAddRequestHeadersW HttpSendRequestW InternetErrorDlg InternetCrackUrlW

wintrust

WTHelperGetProvSignerFromChain CryptCATAdminCalcHashFromFileHandle WTHelperProvDataFromStateData WinVerifyTrust

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

Name

.text

Size

229KB

Virtual Size

229KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

107KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.wixburn

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

advapi32

user32

oleaut32

gdi32

shell32

ole32

kernel32

cabinet

crypt32

msi

rpcrt4

wininet

wintrust

version

generic