file[.]exe | Triage™

General

Target
file.exe
Size 249KB
Sample260211-2drghscs8f
SHA256 3260f9904459efbde89a42a10b6f3f9ec9536bff9375263bc4902ca9effa87dd
MD5 7bf3ce1e5519eb5650667741927825b1
SHA1 babba58908d0ce5bcf1bb85f2e9922a8ca3f52d9
SHA512 064cf4642f2fcd2f662bd5c19d839d0729d799b0249d22bace72da3b20cf4d2e3fc3cd6cadf1c75511b025e3ca484adb36c7ec15f70bb2d9b6391d6f6b1edefa
SSDEEP 6144:Ir/yG2cJOeRJTG+UuQdaVF3kqvohI+LmoqGG:M92cxtGez3kYoi+Mh
TLSH
T139447C1A77940CF9E977813C8952494AE7B2B8150B71DAEF0360835ADF376D09E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 249KB

file.exe

IMPHASH dbf3ebb395a90be1343821c7926930cb
SHA256 3260f9904459efbde89a42a10b6f3f9ec9536bff9375263bc4902ca9effa87dd
MD5 7bf3ce1e5519eb5650667741927825b1
SHA1 babba58908d0ce5bcf1bb85f2e9922a8ca3f52d9
SHA512 064cf4642f2fcd2f662bd5c19d839d0729d799b0249d22bace72da3b20cf4d2e3fc3cd6cadf1c75511b025e3ca484adb36c7ec15f70bb2d9b6391d6f6b1edefa
SSDEEP 6144:Ir/yG2cJOeRJTG+UuQdaVF3kqvohI+LmoqGG:M92cxtGez3kYoi+Mh
TLSH
T139447C1A77940CF9E977813C8952494AE7B2B8150B71DAEF0360835ADF376D09E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

66668

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

wsprintfW

advapi32

RegSetValueExW RegOpenKeyExW RegCloseKey

shell32

SHGetFolderPathW

kernel32

HeapSize SetStdHandle GetConsoleCP FreeEnvironmentStringsW GetConsoleMode SetFilePointerEx FlushFileBuffers GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP SetThreadPriority Sleep GetCurrentThread LoadLibraryA GlobalAlloc GlobalFree GetProcAddress GlobalLock GlobalUnlock WriteFile CreateFileW CloseHandle lstrlenW GetModuleFileNameW CreateMutexW WaitForSingleObject GetFileAttributesW SetFileAttributesW GetLastError CreateThread HeapAlloc GetCurrentProcessId GetProcessHeap FreeLibrary CopyFileW lstrcpyW MultiByteToWideChar WideCharToMultiByte EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW SetLastError InitializeCriticalSectionAndSpinCount WriteConsoleW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetStringTypeW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlPcToFileHeader RaiseException RtlUnwindEx LoadLibraryExW HeapFree HeapReAlloc GetStdHandle ExitProcess GetModuleHandleExW GetACP IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage

Sharing