file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 4.9MB
Sample251223-n3fveswpdz
SHA256 21ef3d9d49fb149f8dde2ffe48f33d0772e6d7e3cc8f4cf7a26ad9c5a1847090
MD5 662258a71a247cc5f3d0ea31009ce9a1
SHA1 332f71963b41ecfb2ef18ab184bb8593a8d74d72
SHA512 a059bee62468d37d6ef82e8677f76e546867921e0259dfbe89c5d8301ea5b004c5c858cf99a0b0d5b1d5f37b306aff5ef42a629816bdf04569358e04db7ab40e
SSDEEP 98304:hl/AAjXGcxEYP/1nfEtl2dEK6+LEyCoYYYLF:hloIGcxEYP/11dH6+gyZYrL
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 4.9MB

file.exe

IMPHASH 95de1cd7eecd16b9d38ba1ad174caf95
SHA256 21ef3d9d49fb149f8dde2ffe48f33d0772e6d7e3cc8f4cf7a26ad9c5a1847090
MD5 662258a71a247cc5f3d0ea31009ce9a1
SHA1 332f71963b41ecfb2ef18ab184bb8593a8d74d72
SHA512 a059bee62468d37d6ef82e8677f76e546867921e0259dfbe89c5d8301ea5b004c5c858cf99a0b0d5b1d5f37b306aff5ef42a629816bdf04569358e04db7ab40e
SSDEEP 98304:hl/AAjXGcxEYP/1nfEtl2dEK6+LEyCoYYYLF:hloIGcxEYP/11dH6+gyZYrL
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1374056

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

DeregisterEventSource RegCloseKey RegEnumKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW RegisterEventSourceW ReportEventW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW

bcrypt

BCryptGetProperty BCryptGenRandom BCryptFinishHash BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptHashData BCryptCreateHash

kernel32

TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RaiseException RtlPcToFileHeader CloseHandle CloseThreadpoolWork CreateEventExW CreateThread CreateThreadpoolWork DeleteCriticalSection DuplicateHandle EnterCriticalSection ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FormatMessageW FreeLibrary GetConsoleOutputCP GetCurrentProcess GetCurrentProcessorNumberEx GetCurrentThread GetDynamicTimeZoneInformation GetEnvironmentVariableW GetFileAttributesExW GetFullPathNameW GetLastError GetLongPathNameW GetModuleFileNameW GetProcAddress GetStdHandle GetSystemDirectoryW GetSystemTime GetThreadPriority GetTickCount64 GetTimeZoneInformation InitializeConditionVariable InitializeCriticalSection IsDebuggerPresent LeaveCriticalSection LoadLibraryExW LocalAlloc LocalFree MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseFailFastException ResetEvent ResumeThread SetEvent SetLastError SetThreadErrorMode SetThreadPriority Sleep SleepConditionVariableCS SubmitThreadpoolWork SystemTimeToFileTime TzSpecificLocalTimeToSystemTime VirtualAlloc VirtualFree WaitForMultipleObjectsEx WaitForSingleObject WakeConditionVariable WideCharToMultiByte WriteFile FlushProcessWriteBuffers WaitForSingleObjectEx AddVectoredExceptionHandler GetModuleHandleW RtlVirtualUnwind RtlCaptureContext RtlRestoreContext VerSetConditionMask FlsAlloc FlsGetValue FlsSetValue CreateEventW SwitchToThread GetCurrentThreadId SuspendThread GetThreadContext SetThreadContext FlushInstructionCache VirtualProtect CreateMemoryResourceNotification QueryInformationJobObject GetModuleHandleExW GetProcessAffinityMask VerifyVersionInfoW InitializeContext GetEnabledXStateFeatures LocateXStateFeature SetXStateFeaturesMask VirtualQuery GetSystemTimeAsFileTime InitializeCriticalSectionEx SleepEx DebugBreak GetCurrentProcessId GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo RtlUnwindEx InitializeSListHead IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlLookupFunctionEntry

ole32

CoGetApartmentType CoUninitialize CoCreateGuid CoWaitForMultipleHandles CoInitializeEx

user32

LoadStringW

api-ms-win-crt-math-l1-1-0

__setusermatherr ceil modf

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode free _callnewh calloc

api-ms-win-crt-string-l1-1-0

strcpy_s _stricmp strlen wcsncmp strcmp

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-runtime-l1-1-0

abort terminate _crt_atexit _register_onexit_function _initialize_onexit_table _cexit _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type _c_exit _configure_wide_argv _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e exit _exit __p___wargv __p___argc

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale