e_win[.]exe | Triage™

General

Target
e_win.exe
Size 79KB
Sample260414-sd6rrsd15p
SHA256 0434726985a08e964c3b9826f52cd50aa33aece7e893f51bacdabdde42dbbc28
MD5 8dee8729eba6cd9df407cf3ed1b221ef
SHA1 b55c26e0f3dff2410fefc6c301dbc955b5294b26
SHA512 1ec140b25a1801229434afe553d7891f74b65ebc1001a16a08c7f9ce758bd877978242c75ff8b02479482887337e8680afbf99fce86033a520101c6b001cc429
SSDEEP 1536:m6UhZM4hubesrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2zs4:ghZ5YesrQLOJgY8Zp8LHD4XWaNH71dLI
TLSH
T17483D8115945E2B6C5D132318167F1AAC13A197003B5B78B63C027AEFB10AE8F6BCF67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e_win.exe

File Explorer

e_win.exe

.exe 79KB

e_win.exe

IMPHASH 202fa14f574c71c2f95878e40a79322d
SHA256 0434726985a08e964c3b9826f52cd50aa33aece7e893f51bacdabdde42dbbc28
MD5 8dee8729eba6cd9df407cf3ed1b221ef
SHA1 b55c26e0f3dff2410fefc6c301dbc955b5294b26
SHA512 1ec140b25a1801229434afe553d7891f74b65ebc1001a16a08c7f9ce758bd877978242c75ff8b02479482887337e8680afbf99fce86033a520101c6b001cc429
SSDEEP 1536:m6UhZM4hubesrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2zs4:ghZ5YesrQLOJgY8Zp8LHD4XWaNH71dLI
TLSH
T17483D8115945E2B6C5D132318167F1AAC13A197003B5B78B63C027AEFB10AE8F6BCF67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

43968

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

OpenProcess GetTickCount GetModuleHandleA GetProcAddress LoadLibraryA lstrcmpW lstrlenW SetVolumeMountPointW CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateFileW WriteFile InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection lstrlenA GetCommandLineW FindClose FindFirstFileW FindNextFileW GetFileSizeEx GetCurrentProcess ReadFile SetFileAttributesW SetFilePointerEx WaitForSingleObject CreateMutexA WaitForMultipleObjects GetCurrentProcessId ExitProcess CreateThread ExitThread SetProcessShutdownParameters GetSystemInfo lstrcmpiW lstrcpyW lstrcatW OpenMutexA MoveFileExW WideCharToMultiByte HeapAlloc HeapFree GetProcessHeap ReleaseSemaphore CreateSemaphoreA TerminateProcess Sleep GetLastError CloseHandle GetVolumePathNamesForVolumeNameW GetDriveTypeW FindVolumeClose FindNextVolumeW GetLogicalDrives FindFirstVolumeW

user32

wsprintfA

advapi32

QueryServiceStatusEx OpenSCManagerA EnumDependentServicesA ControlService CloseServiceHandle CryptAcquireContextW CryptReleaseContext CryptGenRandom OpenServiceA

shell32

SHEmptyRecycleBinA CommandLineToArgvW ShellExecuteW

netapi32

NetShareEnum NetApiBufferFree

rstrtmgr

RmGetList RmStartSession RmEndSession RmRegisterResources

mpr

WNetCloseEnum WNetEnumResourceW WNetOpenEnumW WNetGetConnectionW

Resubmissions

Sharing